turbot/steampipe-mod-terraform-aws-compliance

Control: ElastiCache replication group should be encrypted at rest

Description

This control checks whether all data stored in the Elasticache Replication Group is securely encrypted at rest.

Usage

Run the control in your terminal:

powerpipe control run terraform_aws_compliance.control.elasticache_replication_group_encryption_at_rest_enabled

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run terraform_aws_compliance.control.elasticache_replication_group_encryption_at_rest_enabled --share

SQL

This control uses a named query:

select
address as resource,
case
when (attributes_std ->> 'at_rest_encryption_enabled')::boolean then 'ok'
else 'alarm'
end status,
split_part(address, '.', 2) || case
when (attributes_std ->> 'at_rest_encryption_enabled')::boolean then ' encrypted at rest'
else ' not encrypted at rest'
end || '.' as reason
, path || ':' || start_line
from
terraform_resource
where
type = 'aws_elasticache_replication_group';

Tags