turbot/steampipe-mod-terraform-aws-compliance

Control: EC2 launch configuration should not have a metadata response hop limit greater than 1

Description

This control checks whether EC2 launch configurations have a metadata response hop limit less than 1.

Usage

Run the control in your terminal:

powerpipe control run terraform_aws_compliance.control.ec2_launch_configuration_metadata_hop_limit_check

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run terraform_aws_compliance.control.ec2_launch_configuration_metadata_hop_limit_check --share

SQL

This control uses a named query:

select
address as resource,
case
when (attributes_std -> 'metadata_options' ->> 'http_put_response_hop_limit')::int > 1 then 'alarm'
else 'ok'
end as status,
split_part(address, '.', 2) || case
when (attributes_std -> 'metadata_options' ->> 'http_put_response_hop_limit')::int > 1 then ' metadata response hop limit value is greater than 1'
else ' metadata response hop limit value is less than 1'
end || '.' as reason
, path || ':' || start_line
from
terraform_resource
where
type = 'aws_launch_configuration';

Tags