turbot/steampipe-mod-terraform-aws-compliance

Control: An RDS event notifications subscription should be configured for critical cluster events

Description

This control checks whether an Amazon RDS event subscription exists that has notifications enabled for the following source type, event category key-value pairs.

Usage

Run the control in your terminal:

powerpipe control run terraform_aws_compliance.control.rds_db_cluster_events_subscription

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run terraform_aws_compliance.control.rds_db_cluster_events_subscription --share

SQL

This control uses a named query:

select
address as resource,
case
when (attributes_std ->> 'source_type') <> 'db-cluster' then 'skip'
when (attributes_std ->> 'source_type') = 'db-cluster' and (attributes_std -> 'enabled')::bool and (attributes_std -> 'event_categories_list')::jsonb @> '["failure", "maintenance"]'::jsonb and (attributes_std -> 'event_categories_list')::jsonb <@ '["failure", "maintenance"]'::jsonb then 'ok'
else 'alarm'
end as status,
split_part(address, '.', 2) || case
when (attributes_std ->> 'source_type') <> 'db-cluster' then ' event subscription of ' || (attributes_std ->> 'source_type') || ' type'
when (attributes_std ->> 'source_type') = 'db-cluster' and (attributes_std -> 'enabled')::bool and (attributes_std -> 'event_categories_list')::jsonb @> '["failure", "maintenance"]'::jsonb and (attributes_std -> 'event_categories_list')::jsonb <@ '["failure", "maintenance"]'::jsonb then ' event subscription enabled for critical db cluster events'
else ' event subscription missing critical db cluster events'
end || '.' as reason
, path || ':' || start_line
from
terraform_resource
where
type = 'aws_db_event_subscription';

Tags