Control: VPC Endpoint for SQS should be enabled in all Availability Zones in use a VPC

Description

Using VPC endpoints helps secure traffic by ensuring the data does not traverse the Internet or access public networks. It also helps keep private subnets private. Setting up VPC endpoints can be complicated.

Usage

Run the control in your terminal:

powerpipe control run terraform_aws_compliance.control.sqs_vpc_endpoint_without_dns_resolution

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run terraform_aws_compliance.control.sqs_vpc_endpoint_without_dns_resolution --share

SQL

This control uses a named query:

select
  address as resource,
  case
    when (attributes_std ->> 'service_name') like '%sqs%' and (attributes_std -> 'private_dns_enabled') is null then 'alarm'
    when (attributes_std ->> 'service_name') like '%sqs%' and (attributes_std -> 'private_dns_enabled')::bool then 'ok'
    when (attributes_std ->> 'service_name') like '%sqs%' and (attributes_std -> 'private_dns_enabled')::bool = false then 'alarm'
    else 'alarm'
  end as status,
  split_part(address, '.', 2) || case
    when (attributes_std ->> 'service_name') like '%sqs%' and (attributes_std -> 'private_dns_enabled') is null then ' private DNS disabled'
    when (attributes_std ->> 'service_name') like '%sqs%' and (attributes_std -> 'private_dns_enabled')::bool then ' private DNS enabled'
    when (attributes_std ->> 'service_name') like '%sqs%' and (attributes_std -> 'private_dns_enabled')::bool = false then ' private DNS disabled'
  end || '.' as reason
  
  , path || ':' || start_line
from
  terraform_resource
where
  type = 'aws_vpc_endpoint';

Control: VPC Endpoint for SQS should be enabled in all Availability Zones in use a VPC

Description

Usage

SQL

Tags