Control: EMR cluster security configurations should have EBS encryption enabled
Description
This control checks whether EMR cluster security configurations have EBS encryption enabled.
Usage
Run the control in your terminal:
powerpipe control run terraform_aws_compliance.control.emr_cluster_security_configuration_ebs_encryption_enabled
Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run terraform_aws_compliance.control.emr_cluster_security_configuration_ebs_encryption_enabled --share
SQL
This control uses a named query:
select address as resource, case when ( (attributes_std ->> 'configuration') :: jsonb -> 'EncryptionConfiguration' ->> 'EnableAtRestEncryption' ) :: bool and ( (attributes_std ->> 'configuration') :: jsonb -> 'EncryptionConfiguration' -> 'AtRestEncryptionConfiguration' -> 'LocalDiskEncryptionConfiguration' ->> 'EnableEbsEncryption' ) :: bool then 'ok' else 'alarm' end as status, split_part(address, '.', 2) || case when ( (attributes_std ->> 'configuration') :: jsonb -> 'EncryptionConfiguration' ->> 'EnableAtRestEncryption' ) :: bool and ( (attributes_std ->> 'configuration') :: jsonb -> 'EncryptionConfiguration' -> 'AtRestEncryptionConfiguration' -> 'LocalDiskEncryptionConfiguration' ->> 'EnableEbsEncryption' ) :: bool then ' EBS encryption enabled' else ' EBS encryption disabled' end || '.' as reason, path || ':' || start_linefrom terraform_resourcewhere type = 'aws_emr_security_configuration';