Control: Amazon Redshift clusters should be encrypted with KMS

Description

Ensure if Amazon Redshift clusters are using a specified AWS Key Management Service (AWS KMS) key for encryption. The rule is complaint if encryption is enabled and the cluster is encrypted with the key provided in the kmsKeyArn parameter. The rule is non complaint if the cluster is not encrypted or encrypted with another key.

Usage

Run the control in your terminal:

powerpipe control run terraform_aws_compliance.control.redshift_cluster_kms_enabled

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run terraform_aws_compliance.control.redshift_cluster_kms_enabled --share

SQL

This control uses a named query:

select
  address as resource,
  case
    when (attributes_std -> 'encrypted') is not null and (attributes_std -> 'kms_key_id') is not null then 'ok'
    else 'alarm'
  end status,
  split_part(address, '.', 2) || case
    when (attributes_std -> 'encrypted') is not null and (attributes_std -> 'kms_key_id') is not null then ' encrypted with KMS'
    else ' not encrypted with KMS'
  end || '.' as reason
  
  , path || ':' || start_line
from
  terraform_resource
where
  type = 'aws_redshift_cluster';

Control: Amazon Redshift clusters should be encrypted with KMS

Description

Usage

SQL

Tags