Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

CloudTrail Control doesn't acknowledge organization-level trails Closes #536 #552

Merged
merged 1 commit into from
Mar 10, 2023
Merged

CloudTrail Control doesn't acknowledge organization-level trails Closes #536 #552

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 23 additions & 5 deletions query/cloudtrail/cloudtrail_multi_region_trail_enabled.sql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,17 +10,35 @@ with multi_region_trails as (
group by
account_id,
is_multi_region_trail
), organization_trails as (
select
is_organization_trail,
is_logging,
is_multi_region_trail,
account_id
from
aws_cloudtrail_trail
where
is_organization_trail
)
select
-- Required Columns
a.arn as resource,
distinct a.arn as resource,
case
when coalesce(num_multregion_trails, 0) < 1 then 'alarm'
else 'ok'
when coalesce(num_multregion_trails, 0) >= 1 then 'ok'
when o.is_organization_trail and o.is_logging and o.is_multi_region_trail then 'ok'
when o.is_organization_trail and o.is_multi_region_trail and o.is_logging is null then 'info'
else 'alarm'
end as status,
a.title || ' has ' || coalesce(num_multregion_trails, 0) || ' multi-region trail(s).' as reason,
case
when coalesce(num_multregion_trails, 0) >= 1 then a.title || ' has ' || coalesce(num_multregion_trails, 0) || ' multi-region trail(s).'
when o.is_organization_trail and o.is_logging and o.is_multi_region_trail then a.title || ' has multi-region trail(s).'
when o.is_organization_trail and o.is_multi_region_trail and o.is_logging is null then a.title || ' has organization trail, check organization account for cloudtrail logging status.'
else a.title || ' does not have multi-region trail(s).'
end as reason,
-- Additional Dimensions
a.account_id
from
aws_account as a
left join multi_region_trails as b on a.account_id = b.account_id;
left join multi_region_trails as b on a.account_id = b.account_id
left join organization_trails as o on a.account_id = o.account_id