turbot/steampipe-mod-terraform-aws-compliance

Query: ecs_cluster_logging_encrypted_with_kms_cmk

Usage

powerpipe query terraform_aws_compliance.query.ecs_cluster_logging_encrypted_with_kms_cmk

Steampipe Tables

SQL

select
address as resource,
case
when (
attributes_std -> 'configuration' -> 'execute_command_configuration' ->> 'logging'
) <> 'NONE'
and (
attributes_std -> 'configuration' -> 'execute_command_configuration' ->> 'kms_key_id'
) is not null
and (
(
attributes_std -> 'configuration' -> 'execute_command_configuration' -> 'log_configuration' ->> 'cloud_watch_encryption_enabled'
) :: boolean
or (
attributes_std -> 'configuration' -> 'execute_command_configuration' -> 'log_configuration' ->> 's3_bucket_encryption_enabled'
) :: boolean
) then 'ok'
else 'alarm'
end as status,
split_part(address, '.', 2) || case
when (
attributes_std -> 'configuration' -> 'execute_command_configuration' ->> 'logging'
) <> 'NONE'
and (
attributes_std -> 'configuration' -> 'execute_command_configuration' ->> 'kms_key_id'
) is not null
and (
(
attributes_std -> 'configuration' -> 'execute_command_configuration' -> 'log_configuration' ->> 'cloud_watch_encryption_enabled'
) :: boolean
or (
attributes_std -> 'configuration' -> 'execute_command_configuration' -> 'log_configuration' ->> 's3_bucket_encryption_enabled'
) :: boolean
) then ' cluster logging encrypted with kms cmk'
when (
attributes_std -> 'configuration' -> 'execute_command_configuration' ->> 'logging'
) = 'NONE'
or (
attributes_std -> 'configuration' -> 'execute_command_configuration' ->> 'logging'
) is null then ' cluster logging disabled'
else ' cluster logging not encrypted with kms cmk'
end || '.' as reason,
path || ':' || start_line
from
terraform_resource
where
type = 'aws_ecs_cluster';

Controls

The query is being used by the following controls: