Control: ECR repository policy should prohibit public access

powerpipe control run terraform_aws_compliance.control.ecr_repository_policy_prohibit_public_access

powerpipe login
powerpipe control run terraform_aws_compliance.control.ecr_repository_policy_prohibit_public_access --share

with ecr_non_public_policies as (
  select
    distinct (address) as name
  from
    terraform_resource,
    jsonb_array_elements(
      case
        when ((attributes_std ->> 'policy') = '') then null
        else ((attributes_std ->> 'policy') :: jsonb -> 'Statement')
      end
    ) as s
  where
    type = 'aws_ecr_repository_policy'
    and (
      ((s ->> 'Principal') != '*')
      or (
        (
          s -> 'Condition' -> 'StringEquals' ->> 'aws:PrincipalOrgID'
        ) is not null
      )
      or (
        (
          s -> 'Condition' -> 'ForAllValues:StringEquals' ->> 'aws:PrincipalOrgID'
        ) is not null
      )
      or (
        (
          s -> 'Condition' -> 'ForAnyValue:StringEquals' ->> 'aws:PrincipalOrgID'
        ) is not null
      )
    )
)
select
  b.address as resource,
  case
    when (attributes_std ->> 'policy') = '' then 'ok'
    when d.name is not null then 'ok'
    else 'alarm'
  end status,
  split_part(b.address, '.', 2) || case
    when (attributes_std ->> 'policy') = '' then ' no policy defined'
    when d.name is not null then ' not public'
    else ' public'
  end || '.' reason,
  path || ':' || start_line
from
  terraform_resource as b
  left join ecr_non_public_policies as d on d.name = b.address
where
  type = 'aws_ecr_repository_policy';