Control: Resource logs in Logic Apps should be enabled

Description

Audit enabling of resource logs. This enables you to recreate activity trails to use for investigation purposes; when a security incident occurs or when your network is compromised.

Usage

Run the control in your terminal:

powerpipe control run terraform_azure_compliance.control.logic_app_workflow_logging_enabled

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run terraform_azure_compliance.control.logic_app_workflow_logging_enabled --share

SQL

This control uses a named query:

select
  address as resource,
  case
    when name in (select split_part((attributes_std ->> 'target_resource_id'), '.', 3) from terraform_resource where type = 'azurerm_monitor_diagnostic_setting' and split_part((attributes_std ->> 'target_resource_id'), '.', 2) = 'azurerm_logic_app_workflow')then 'ok'
    else 'alarm'
  end status,
  split_part(address, '.', 2) || case
    when name in (select split_part((attributes_std ->> 'target_resource_id'), '.', 3) from terraform_resource where type = 'azurerm_monitor_diagnostic_setting' and split_part((attributes_std ->> 'target_resource_id'), '.', 2) = 'azurerm_logic_app_workflow')then ' logging enabled'
    else ' logging disabled'
  end || '.' reason
  
  , path || ':' || start_line
from
  terraform_resource
where
  type = 'azurerm_logic_app_workflow';

Control: Resource logs in Logic Apps should be enabled

Description

Usage

SQL

Tags