turbot/steampipe-mod-terraform-aws-compliance

Control: EC2 launch template should not have a metadata response hop limit greater than 1

Description

This control checks whether EC2 launch templates have a metadata response hop limit less than 1.

Usage

Run the control in your terminal:

powerpipe control run terraform_aws_compliance.control.ec2_launch_template_metadata_hop_limit_check

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run terraform_aws_compliance.control.ec2_launch_template_metadata_hop_limit_check --share

SQL

This control uses a named query:

select
address as resource,
case
when (attributes_std -> 'metadata_options' ->> 'http_put_response_hop_limit')::int > 1 then 'alarm'
else 'ok'
end as status,
split_part(address, '.', 2) || case
when (attributes_std -> 'metadata_options' ->> 'http_put_response_hop_limit')::int > 1 then ' metadata response hop limit value is greater than 1'
else ' metadata response hop limit value is not less than 1'
end || '.' as reason
, path || ':' || start_line
from
terraform_resource
where
type = 'aws_launch_template';

Tags