Control: Ensure that the log metric filter and alerts exist for SQL instance configuration changes

powerpipe control run gcp_compliance.control.logging_metric_alert_sql_instance_configuration_changes

powerpipe login
powerpipe control run gcp_compliance.control.logging_metric_alert_sql_instance_configuration_changes --share

with filter_data as (
  select
    m.project as project,
    display_name alert_name,
    count(m.name) metric_name
  from
    gcp_monitoring_alert_policy,
    jsonb_array_elements(conditions) as filter_condition
    join gcp_logging_metric m on m.filter ~ '\s*protoPayload.methodName\s*=\s*"cloudsql.instances.update"\s*'
    and filter_condition -> 'conditionThreshold' ->> 'filter' like '%metric.type="' || m.metric_descriptor_type || '"%'
  where
    enabled
  group by
    m.project, display_name, m.name
)
select
  'https://cloudresourcemanager.googleapis.com/v1/projects/' || project_id resource,
  case
    when d.metric_name > 0 then 'ok'
    else 'alarm'
  end as status,
  case
    when d.metric_name > 0
      then 'Log metric and alert exist for SQL instance configuration changes.'
    else 'Log metric and alert do not exist for SQL instance configuration changes.'
  end as reason
  
  , project_id as project
from
  gcp_project as p
  left join filter_data as d on d.project = p.name