Fix multiple CloudTrail, CloudWatch, Config, Lambda, and S3 queries t…

…o work properly with multi-account connections fixes #250 (#247)

Co-authored-by: John Smyth <john@turbot.com>

query/cloudtrail/cloudtrail_multi_region_trail_enabled.sql

@@ -1,25 +1,26 @@
 with multi_region_trails as (
   select
-    count(account_id),
-    string_agg(account_id, ',') as account_id
+    account_id,
+    count(account_id) as num_multregion_trails
   from
     aws_cloudtrail_trail
   where
     is_multi_region_trail
     and is_logging
   group by
+    account_id,
     is_multi_region_trail
 )
 select
   -- Required Columns
   a.arn as resource,
   case
-    when b.count < 1 then 'alarm'
+    when coalesce(num_multregion_trails, 0)  < 1 then 'alarm'
     else 'ok'
   end as status,
-  a.title || ' has ' || coalesce(b.count, 0) || ' multi-region trail(s).' as reason,
+  a.title || ' has ' || coalesce(num_multregion_trails, 0) || ' multi-region trail(s).' as reason,
   -- Additional Dimensions
   a.account_id
 from
   aws_account as a
-left join multi_region_trails as b on a.account_id = split_part(b.account_id, ',', 1);
+left join multi_region_trails as b on a.account_id = b.account_id;

query/cloudtrail/cloudtrail_s3_logging_enabled.sql

@@ -14,4 +14,6 @@ select
   t.account_id
 from
   aws_cloudtrail_trail t
-  inner join aws_s3_bucket b on t.s3_bucket_name = b.name;
+  inner join aws_s3_bucket b on t.s3_bucket_name = b.name
+where 
+  t.region = t.home_region;

query/cloudtrail/cloudtrail_trail_integrated_with_logs.sql

@@ -13,4 +13,6 @@ select
   region,
   account_id
 from
-  aws_cloudtrail_trail;
+  aws_cloudtrail_trail
+where 
+  region = home_region;

query/cloudtrail/cloudtrail_trail_logs_encrypted_with_kms_cmk.sql

@@ -13,4 +13,6 @@ select
   region,
   account_id
 from
-  aws_cloudtrail_trail;
+  aws_cloudtrail_trail
+where 
+  region = home_region;

query/cloudtrail/cloudtrail_trail_validation_enabled.sql

@@ -13,4 +13,6 @@ select
   region,
   account_id
 from
-  aws_cloudtrail_trail;
+  aws_cloudtrail_trail
+where 
+  region = home_region;

query/cloudwatch/log_metric_filter_bucket_policy.sql

@@ -29,7 +29,7 @@ with filter_data as (
 )
 select
   -- Required Columns
-  'arn:' || a.partition || ':::' || a.account_id as resource,
+  distinct 'arn:' || a.partition || ':::' || a.account_id as resource,
   case
     when f.trail_name is null then 'alarm'
     else 'ok'
@@ -43,4 +43,3 @@ select
 from
   aws_account as a
   left join filter_data as f on a.account_id = f.account_id
-limit 1

query/cloudwatch/log_metric_filter_cloudtrail_configuration.sql

@@ -28,7 +28,7 @@ with filter_data as (
 )
 select
   -- Required Columns
-  'arn:' || a.partition || ':::' || a.account_id as resource,
+  distinct 'arn:' || a.partition || ':::' || a.account_id as resource,
   case
     when f.trail_name is null then 'alarm'
     else 'ok'
@@ -42,4 +42,3 @@ select
 from
   aws_account as a
   left join filter_data as f on a.account_id = f.account_id
-limit 1

query/cloudwatch/log_metric_filter_config_configuration.sql

@@ -28,7 +28,7 @@ with filter_data as (
 )
 select
   -- Required Columns
-  'arn:' || a.partition || ':::' || a.account_id as resource,
+  distinct 'arn:' || a.partition || ':::' || a.account_id as resource,
   case
     when f.trail_name is null then 'alarm'
     else 'ok'
@@ -42,4 +42,3 @@ select
 from
   aws_account as a
   left join filter_data as f on a.account_id = f.account_id
-limit 1

query/cloudwatch/log_metric_filter_console_authentication_failure.sql

@@ -28,7 +28,7 @@ with filter_data as (
 )
 select
   -- Required Columns
-  'arn:' || a.partition || ':::' || a.account_id as resource,
+  distinct 'arn:' || a.partition || ':::' || a.account_id as resource,
   case
     when f.trail_name is null then 'alarm'
     else 'ok'
@@ -42,4 +42,3 @@ select
 from
   aws_account as a
   left join filter_data as f on a.account_id = f.account_id
-limit 1

query/cloudwatch/log_metric_filter_console_login_mfa.sql

@@ -28,7 +28,7 @@ with filter_data as (
 )
 select
   -- Required Columns
-  'arn:' || a.partition || ':::' || a.account_id as resource,
+  distinct 'arn:' || a.partition || ':::' || a.account_id as resource,
   case
     when f.trail_name is null then 'alarm'
     else 'ok'
@@ -42,4 +42,3 @@ select
 from
   aws_account as a
   left join filter_data as f on a.account_id = f.account_id
-limit 1

query/cloudwatch/log_metric_filter_disable_or_delete_cmk.sql

@@ -28,7 +28,7 @@ with filter_data as (
 )
 select
   -- Required Columns
-  'arn:' || a.partition || ':::' || a.account_id as resource,
+  distinct 'arn:' || a.partition || ':::' || a.account_id as resource,
   case
     when f.trail_name is null then 'alarm'
     else 'ok'
@@ -42,4 +42,3 @@ select
 from
   aws_account as a
   left join filter_data as f on a.account_id = f.account_id
-limit 1

query/cloudwatch/log_metric_filter_iam_policy.sql

@@ -29,7 +29,7 @@ with filter_data as (
 )
 select
   -- Required Columns
-  'arn:' || a.partition || ':::' || a.account_id as resource,
+  distinct 'arn:' || a.partition || ':::' || a.account_id as resource,
   case
     when f.trail_name is null then 'alarm'
     else 'ok'
@@ -43,4 +43,3 @@ select
 from
   aws_account as a
   left join filter_data as f on a.account_id = f.account_id
-limit 1

query/cloudwatch/log_metric_filter_network_acl.sql

@@ -28,7 +28,7 @@ with filter_data as (
 )
 select
   -- Required Columns
-  'arn:' || a.partition || ':::' || a.account_id as resource,
+  distinct 'arn:' || a.partition || ':::' || a.account_id as resource,
   case
     when f.trail_name is null then 'alarm'
     else 'ok'
@@ -42,4 +42,3 @@ select
 from
   aws_account as a
   left join filter_data as f on a.account_id = f.account_id
-limit 1

query/cloudwatch/log_metric_filter_network_gateway.sql

@@ -29,7 +29,7 @@ with filter_data as (
 )
 select
   -- Required Columns
-  'arn:' || a.partition || ':::' || a.account_id as resource,
+  distinct 'arn:' || a.partition || ':::' || a.account_id as resource,
   case
     when f.trail_name is null then 'alarm'
     else 'ok'
@@ -43,4 +43,3 @@ select
 from
   aws_account as a
   left join filter_data as f on a.account_id = f.account_id
-limit 1

query/cloudwatch/log_metric_filter_organization.sql

@@ -29,7 +29,7 @@ with filter_data as (
 )
 select
   -- Required Columns
-  'arn:' || a.partition || ':::' || a.account_id as resource,
+  distinct 'arn:' || a.partition || ':::' || a.account_id as resource,
   case
     when f.trail_name is null then 'alarm'
     else 'ok'
@@ -43,4 +43,3 @@ select
 from
   aws_account as a
   left join filter_data as f on a.account_id = f.account_id
-limit 1

query/cloudwatch/log_metric_filter_root_login.sql

@@ -28,7 +28,7 @@ with filter_data as (
 )
 select
   -- Required Columns
-  'arn:' || a.partition || ':::' || a.account_id as resource,
+  distinct 'arn:' || a.partition || ':::' || a.account_id as resource,
   case
     when f.trail_name is null then 'alarm'
     else 'ok'
@@ -41,5 +41,4 @@ select
   a.account_id
 from
   aws_account as a
-  left join filter_data as f on a.account_id = f.account_id
-limit 1
+  left join filter_data as f on a.account_id = f.account_id

query/cloudwatch/log_metric_filter_route_table.sql

@@ -29,7 +29,7 @@ with filter_data as (
 )
 select
   -- Required Columns
-  'arn:' || a.partition || ':::' || a.account_id as resource,
+  distinct 'arn:' || a.partition || ':::' || a.account_id as resource,
   case
     when f.trail_name is null then 'alarm'
     else 'ok'
@@ -43,4 +43,3 @@ select
 from
   aws_account as a
   left join filter_data as f on a.account_id = f.account_id
-limit 1

query/cloudwatch/log_metric_filter_security_group.sql

@@ -28,7 +28,7 @@ with filter_data as (
 )
 select
   -- Required Columns
-  'arn:' || a.partition || ':::' || a.account_id as resource,
+  distinct 'arn:' || a.partition || ':::' || a.account_id as resource,
   case
     when f.trail_name is null then 'alarm'
     else 'ok'
@@ -42,4 +42,3 @@ select
 from
   aws_account as a
   left join filter_data as f on a.account_id = f.account_id
-limit 1

query/cloudwatch/log_metric_filter_unauthorized_api.sql

@@ -31,7 +31,7 @@ with filter_data as (
 )
 select
   -- Required Columns
-  'arn:' || a.partition || ':::' || a.account_id as resource,
+  distinct 'arn:' || a.partition || ':::' || a.account_id as resource,
   case
     when f.trail_name is null then 'alarm'
     else 'ok'
@@ -45,4 +45,3 @@ select
 from
   aws_account as a
   left join filter_data as f on a.account_id = f.account_id
-limit 1

query/cloudwatch/log_metric_filter_vpc.sql

@@ -29,7 +29,7 @@ with filter_data as (
 )
 select
   -- Required Columns
-  'arn:' || a.partition || ':::' || a.account_id as resource,
+  distinct 'arn:' || a.partition || ':::' || a.account_id as resource,
   case
     when f.trail_name is null then 'alarm'
     else 'ok'
@@ -43,4 +43,3 @@ select
 from
   aws_account as a
   left join filter_data as f on a.account_id = f.account_id
-limit 1

query/config/config_enabled_all_regions.sql

@@ -33,4 +33,5 @@ select
   a.account_id
 from
   aws_region as a
-  left join aws_config_configuration_recorder as r on r.region = a.name;
+  left join aws_config_configuration_recorder as r 
+    on r.account_id = a.account_id and r.region = a.name;

query/lambda/lambda_function_use_latest_runtime.sql

@@ -6,8 +6,8 @@ select
     else 'alarm'
   end as status,
   case
-    when runtime in ('nodejs14.x', 'nodejs12.x', 'nodejs10.x', 'python3.8', 'python3.7', 'python3.6', 'ruby2.5', 'ruby2.7', 'java11', 'java8', 'go1.x', 'dotnetcore2.1', 'dotnetcore3.1') then title || ' uses latest runtimes.'
-    else title || ' uses latest runtimes.'
+    when runtime in ('nodejs14.x', 'nodejs12.x', 'nodejs10.x', 'python3.8', 'python3.7', 'python3.6', 'ruby2.5', 'ruby2.7', 'java11', 'java8', 'go1.x', 'dotnetcore2.1', 'dotnetcore3.1') then title || ' uses latest runtime - ' || runtime || '.'
+    else title || ' uses ' || runtime || ' which is not the latest version.'
   end as reason,
   -- Additional Dimensions
   region,

query/s3/s3_public_access_block_bucket_account.sql

@@ -28,4 +28,6 @@ select
   bucket.account_id
 from
   aws_s3_bucket as bucket,
-  aws_s3_account_settings as s3account;
+  aws_s3_account_settings as s3account
+where
+  s3account.account_id = bucket.account_id;