Control: An RDS event notifications subscription should be configured for critical database security group events

powerpipe control run terraform_aws_compliance.control.rds_db_security_group_events_subscription

powerpipe login
powerpipe control run terraform_aws_compliance.control.rds_db_security_group_events_subscription --share

select
  address as resource,
  case
    when (attributes_std ->> 'source_type') <> 'db-security-group' then 'skip'
    when
      (attributes_std ->> 'source_type') = 'db-security-group'
      and (attributes_std -> 'enabled')::bool
      and (attributes_std -> 'event_categories_list')::jsonb @> '["failure", "configuration change"]'::jsonb
      and (attributes_std -> 'event_categories_list')::jsonb <@ '["failure", "configuration change"]'::jsonb then 'ok'
    else 'alarm'
  end as status,
  split_part(address, '.', 2) || case
    when (attributes_std ->> 'source_type') <> 'db-security-group' then ' event subscription of ' || (attributes_std ->> 'source_type') || ' type'
    when
      (attributes_std ->> 'source_type') = 'db-security-group'
      and (attributes_std -> 'enabled')::bool and (attributes_std -> 'event_categories_list')::jsonb @> '["failure", "configuration change"]'::jsonb
      and (attributes_std -> 'event_categories_list')::jsonb <@ '["failure", "configuration change"]'::jsonb then ' event subscription enabled for critical database security group events'
    else ' event subscription missing critical database security group events'
  end || '.' as reason
  
  , path || ':' || start_line
from
  terraform_resource
where
  type = 'aws_db_event_subscription';