Control: Backup plan min frequency and min retention check

Description

Checks if a backup plan has a backup rule that satisfies the required frequency and retention period(35 days). The rule is non complaint if recovery points are not created at least as often as the specified frequency or expire before the specified period.

Usage

Run the control in your terminal:

powerpipe control run terraform_aws_compliance.control.backup_plan_min_retention_35_days

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run terraform_aws_compliance.control.backup_plan_min_retention_35_days --share

SQL

This control uses a named query:

select
  address as resource,
  case
    when (attributes_std -> 'rule') is null then 'alarm'
    when (attributes_std -> 'rule' -> 'lifecycle') is null then 'ok'
    when (attributes_std -> 'rule' -> 'lifecycle' ->> 'delete_after')::int >=35 then 'ok'
    else 'alarm'
  end status,
  split_part(address, '.', 2) || case
    when (attributes_std -> 'rule') is null then ' retention period not set'
    when (attributes_std -> 'rule' -> 'lifecycle') is null then ' retention period set to never expire'
    else ' retention period set to ' || (attributes_std -> 'rule' -> 'lifecycle' ->> 'delete_after')::int
  end || '.' reason
  
  , path || ':' || start_line
from
  terraform_resource
where
  type = 'aws_backup_plan';

Control: Backup plan min frequency and min retention check

Description

Usage

SQL

Tags