Control: Glacier vault should restrict public access

powerpipe control run terraform_aws_compliance.control.glacier_vault_restrict_public_access

powerpipe login
powerpipe control run terraform_aws_compliance.control.glacier_vault_restrict_public_access --share

with glacier_vault_public_policies as (
  select
    distinct (address ) as name
  from
    terraform_resource,
    jsonb_array_elements(
      case when ((attributes_std ->> 'access_policy') = '')
        then null
        else ((attributes_std ->> 'access_policy')::jsonb -> 'Statement') end
    ) as s
  where
    type = 'aws_glacier_vault'
    and (s ->> 'Effect') = 'Allow'
    and (
      (s ->> 'Principal') = '*'
      or (s -> 'Principal' ->> 'AWS') = '*'
      or (s -> 'Principals' -> 'AWS') @> '["*"]'
      or (s -> 'Principals' -> '*') @> '["*"]'
    )
)
select
  r.address as resource,
  case
    when (attributes_std ->> 'access_policy') = '' then 'ok'
    when p.name is null then 'ok'
    else 'alarm'
  end status,
  split_part(r.address, '.', 2) || case
    when (attributes_std ->> 'access_policy') = '' then ' no policy defined'
    when p.name is null then ' not publicly accessible'
    else ' publicly accessible'
  end || '.' reason
  
  , path || ':' || start_line
from
  terraform_resource as r
  left join glacier_vault_public_policies as p on p.name = r.address
where
  r.type = 'aws_glacier_vault';