Control: Redundant enabled global ActionTrail trails should be reviewed
Your ActionTrail trails in each account are charged based on the billing policies of an Object Storage Service (OSS) bucket or a Log Service Logstore.
steampipe check alicloud_thrifty.control.actiontrail_multiple_global_trails
Plugins & Tables
with global_trails as (selectcount(*) as totalfromalicloud_action_trailwheretrail_region = 'All'and status = 'Enable')select'acs:actiontrail:' || home_region || ':' || account_id || ':actiontrail/' || name as resource,casewhen total > 1 then 'alarm'else 'ok'end as status,casewhen total > 1 then name || ' is one of ' || total || ' global trails.'else name || ' is the only global trail.'end as reason,region,account_idfromalicloud_action_trail,global_trailswheretrail_region = 'All'and status = 'Enable';