turbot/tailpipe-mod-aws-cloudtrail-log-detections

Query: sqs_queue_dlq_disabled

Usage

powerpipe query aws_cloudtrail_log_detections.query.sqs_queue_dlq_disabled

Tailpipe Tables

SQL

select
tp_timestamp as timestamp,
string_split(event_source, '.')[1] || ':' || event_name as operation,
coalesce(response_elements ->> 'queueUrl', request_parameters ->> 'queueUrl') as resource,
user_identity.arn as actor,
tp_source_ip as source_ip,
tp_index as account_id,
aws_region as region,
tp_id as source_id,
*
from
aws_cloudtrail_log
where
event_source = 'sqs.amazonaws.com'
and event_name = 'SetQueueAttributes'
and (request_parameters -> 'attributes' ->> 'RedrivePolicy') = ''
and error_code is null
order by
event_time desc;

Detections

The query is being used by the following detections: