Control: Elasticsearch domain should not use the default security group

Description

This control checks whether Elasticsearch domains are configured to use the default security group. This control fails if the Elasticsearch domain uses the default security group.

Usage

Run the control in your terminal:

powerpipe control run terraform_aws_compliance.control.es_domain_use_default_security_group

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run terraform_aws_compliance.control.es_domain_use_default_security_group --share

SQL

This control uses a named query:

select
  address as resource,
  case
    when (attributes_std -> 'vpc_options' ->> 'security_group_ids') is not null then 'ok'
    else 'alarm'
  end status,
  split_part(address, '.', 2) || case
    when (attributes_std -> 'vpc_options' ->> 'security_group_ids') is not null then ' default security group not set'
    else ' default security group set'
  end || '.' reason
  
  , path || ':' || start_line
from
  terraform_resource
where
  type = 'aws_elasticsearch_domain';

Control: Elasticsearch domain should not use the default security group

Description

Usage

SQL

Tags