Control: Unused network access control lists should be removed

Description

This control checks whether there are any unused network access control lists (ACLs). The control checks the item configuration of the resource AWS::EC2::NetworkAcl and determines the relationships of the network ACL.

Usage

Run the control in your terminal:

powerpipe control run terraform_aws_compliance.control.vpc_network_acl_unused

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run terraform_aws_compliance.control.vpc_network_acl_unused --share

SQL

This control uses a named query:

select
  address as resource,
  case
    when (attributes_std -> 'subnet_ids') is null then 'alarm'
    else 'ok'
  end status,
  split_part(address, '.', 2) || case
    when (attributes_std -> 'subnet_ids') is null then ' not associated with subnets'
    else ' associated with ' || (jsonb_array_length(attributes_std -> 'subnet_ids')) || ' subnet(s)'
  end || '.' as reason
  
  , path || ':' || start_line
from
  terraform_resource
where
  type = 'aws_network_acl';

Control: Unused network access control lists should be removed

Description

Usage

SQL

Tags