Control: EC2 launch template should not have a metadata response hop limit greater than 1
Description
This control checks whether EC2 launch templates have a metadata response hop limit less than 1.
Usage
Run the control in your terminal:
powerpipe control run terraform_aws_compliance.control.ec2_launch_template_metadata_hop_limit_check
Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run terraform_aws_compliance.control.ec2_launch_template_metadata_hop_limit_check --share
SQL
This control uses a named query:
select address as resource, case when (attributes_std -> 'metadata_options' ->> 'http_put_response_hop_limit')::int > 1 then 'alarm' else 'ok' end as status, split_part(address, '.', 2) || case when (attributes_std -> 'metadata_options' ->> 'http_put_response_hop_limit')::int > 1 then ' metadata response hop limit value is greater than 1' else ' metadata response hop limit value is not less than 1' end || '.' as reason , path || ':' || start_linefrom terraform_resourcewhere type = 'aws_launch_template';