turbot/terraform_aws_compliance

Query: cloudwatch_destination_policy_wildcards

Usage

powerpipe query terraform_aws_compliance.query.cloudwatch_destination_policy_wildcards

SQL

with access_policy as (
select
name
from
terraform_data_source
where
type = 'aws_iam_policy_document'
and (arguments -> 'statement' ->> 'actions') like '%*%'
), cloudwatch_log_destination_policy as (
select
name,
type,
address,
path,
start_line,
_ctx,
split_part((attributes_std ->> 'access_policy')::text, '.', 3) as ap
from
terraform_resource
where
type = 'aws_cloudwatch_log_destination_policy'
)
select
a.address as resource,
case
when e.name is null then 'ok'
else 'alarm'
end as status,
split_part(a.address, '.', 2) || case
when e.name is null then ' policy is ok'
else ' policy is not ok'
end || '.' as reason
, path || ':' || start_line
from
cloudwatch_log_destination_policy as a
left join access_policy as e on a.ap = e.name;

Controls

The query is being used by the following controls: