turbot/terraform_gcp_compliance

Query: kms_key_not_publicly_accessible

Usage

powerpipe query terraform_gcp_compliance.query.kms_key_not_publicly_accessible

Steampipe Tables

SQL

select
address as resource,
case
when (attributes_std ->> 'member') in ('allUsers','allAuthenticatedUsers') or (attributes_std -> 'members') @> '["allUsers"]' or (attributes_std -> 'members') @> '["allAuthenticatedUsers"]' then 'alarm'
else 'ok'
end as status,
split_part(address, '.', 2) || case
when (attributes_std ->> 'member') in ('allUsers','allAuthenticatedUsers') or (attributes_std -> 'members') @> '["allUsers"]' or (attributes_std -> 'members') @> '["allAuthenticatedUsers"]' then ' is publicly accessible'
else ' is not publicly accessible'
end || '.' reason
, path || ':' || start_line
from
terraform_resource
where
type in ('google_kms_crypto_key_iam_policy', 'google_kms_crypto_key_iam_binding', 'google_kms_crypto_key_iam_member');

Controls

The query is being used by the following controls: