Control: An RDS event notifications subscription should be configured for critical cluster events
Description
This control checks whether an Amazon RDS event subscription exists that has notifications enabled for the following source type, event category key-value pairs.
Usage
Run the control in your terminal:
powerpipe control run terraform_aws_compliance.control.rds_db_cluster_events_subscription
Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run terraform_aws_compliance.control.rds_db_cluster_events_subscription --share
SQL
This control uses a named query:
select address as resource, case when (attributes_std ->> 'source_type') <> 'db-cluster' then 'skip' when (attributes_std ->> 'source_type') = 'db-cluster' and (attributes_std -> 'enabled')::bool and (attributes_std -> 'event_categories_list')::jsonb @> '["failure", "maintenance"]'::jsonb and (attributes_std -> 'event_categories_list')::jsonb <@ '["failure", "maintenance"]'::jsonb then 'ok' else 'alarm' end as status, split_part(address, '.', 2) || case when (attributes_std ->> 'source_type') <> 'db-cluster' then ' event subscription of ' || (attributes_std ->> 'source_type') || ' type' when (attributes_std ->> 'source_type') = 'db-cluster' and (attributes_std -> 'enabled')::bool and (attributes_std -> 'event_categories_list')::jsonb @> '["failure", "maintenance"]'::jsonb and (attributes_std -> 'event_categories_list')::jsonb <@ '["failure", "maintenance"]'::jsonb then ' event subscription enabled for critical db cluster events' else ' event subscription missing critical db cluster events' end || '.' as reason , path || ':' || start_linefrom terraform_resourcewhere type = 'aws_db_event_subscription';