turbot/aws_compliance

GitHub
account_part_of_organizationsacm_certificate_expires_30_daysacm_certificate_no_wildcard_domain_nameacm_certificate_transparency_logging_enabledapigateway_rest_api_authorizers_configuredapigateway_rest_api_stage_use_ssl_certificateapigateway_rest_api_stage_xray_tracing_enabledapigateway_stage_cache_encryption_at_rest_enabledapigateway_stage_logging_enabledapigateway_stage_use_waf_web_aclautoscaling_group_multiple_az_configuredautoscaling_group_no_suspended_processeautoscaling_group_with_lb_use_health_checkautoscaling_launch_config_hop_limitautoscaling_launch_config_public_ip_disabledautoscaling_launch_config_requires_imdsv2backup_plan_min_retention_35_daysbackup_recovery_point_encryption_enabledbackup_recovery_point_manual_deletion_disabledbackup_recovery_point_min_retention_35_dayscloudformation_stack_notifications_enabledcloudformation_stack_output_no_secretscloudformation_stack_rollback_enabledcloudfront_distribution_configured_with_origin_failovercloudfront_distribution_custom_origins_encryption_in_transit_enabledcloudfront_distribution_default_root_object_configuredcloudfront_distribution_encryption_in_transit_enabledcloudfront_distribution_geo_restrictions_enabledcloudfront_distribution_logging_enabledcloudfront_distribution_no_deprecated_ssl_protocolcloudfront_distribution_origin_access_identity_enabledcloudfront_distribution_sni_enabledcloudfront_distribution_use_custom_ssl_certificatecloudfront_distribution_waf_enabledcloudtrail_bucket_not_publiccloudtrail_multi_region_read_write_enabledcloudtrail_multi_region_trail_enabledcloudtrail_s3_data_events_enabledcloudtrail_s3_logging_enabledcloudtrail_s3_object_read_events_audit_enabledcloudtrail_s3_object_write_events_audit_enabledcloudtrail_security_trail_enabledcloudtrail_trail_enabledcloudtrail_trail_integrated_with_logscloudtrail_trail_logs_encrypted_with_kms_cmkcloudtrail_trail_validation_enabledcloudwatch_alarm_action_enabledcloudwatch_log_group_retention_period_365codebuild_project_environment_privileged_mode_disabledcodebuild_project_logging_enabledcodebuild_project_plaintext_env_variables_no_sensitive_aws_valuescodebuild_project_source_repo_oauth_configuredconfig_enabled_all_regionsdax_cluster_encryption_at_rest_enableddms_replication_instance_not_publicly_accessibledynamodb_table_auto_scaling_enableddynamodb_table_encrypted_with_kmsdynamodb_table_encryption_enableddynamodb_table_in_backup_plandynamodb_table_point_in_time_recovery_enableddynamodb_table_protected_by_backup_planebs_attached_volume_delete_on_termination_enabledebs_attached_volume_encryption_enabledebs_snapshot_not_publicly_restorableebs_volume_encryption_at_rest_enabledebs_volume_in_backup_planebs_volume_protected_by_backup_planebs_volume_unusedec2_classic_lb_connection_draining_enabledec2_ebs_default_encryption_enabledec2_instance_detailed_monitoring_enabledec2_instance_ebs_optimizedec2_instance_iam_profile_attachedec2_instance_in_vpcec2_instance_no_amazon_key_pairec2_instance_no_launch_wizard_security_groupec2_instance_not_publicly_accessibleec2_instance_not_use_multiple_enisec2_instance_protected_by_backup_planec2_instance_publicly_accessible_iam_profile_attachedec2_instance_ssm_managedec2_instance_termination_protection_enabledec2_instance_user_data_no_secretsec2_instance_uses_imdsv2ec2_instance_virtualization_type_no_paravirtualec2_stopped_instance_30_daysec2_transit_gateway_auto_cross_account_attachment_disabledecr_repository_image_scan_on_push_enabledecr_repository_lifecycle_policy_configuredecr_repository_prohibit_public_accessecr_repository_tag_immutability_enabledecs_cluster_container_insights_enabledecs_service_fargate_using_latest_platform_versionecs_service_not_publicly_accessibleecs_task_definition_container_environment_no_secretecs_task_definition_container_non_privilegedecs_task_definition_container_readonly_root_filesystemecs_task_definition_logging_enabledecs_task_definition_no_host_pid_modeecs_task_definition_user_for_host_mode_checkefs_access_point_enforce_root_directoryefs_access_point_enforce_user_identityefs_file_system_automatic_backups_enabledefs_file_system_encrypt_data_at_restefs_file_system_encrypted_with_cmkefs_file_system_enforces_sslefs_file_system_protected_by_backup_planeks_cluster_control_plane_audit_logging_enabledeks_cluster_endpoint_restrict_public_accesseks_cluster_no_default_vpceks_cluster_secrets_encryptedeks_cluster_with_latest_kubernetes_versionelastic_beanstalk_enhanced_health_reporting_enabledelasticache_redis_cluster_automatic_backup_retention_15_dayselb_application_classic_lb_logging_enabledelb_application_classic_network_lb_prohibit_public_accesselb_application_gateway_network_lb_multiple_az_configuredelb_application_lb_deletion_protection_enabledelb_application_lb_desync_mitigation_modeelb_application_lb_drop_http_headerselb_application_lb_redirect_http_request_to_httpselb_application_lb_waf_enabledelb_application_lb_with_outbound_ruleelb_application_network_lb_use_ssl_certificateelb_classic_lb_cross_zone_load_balancing_enabledelb_classic_lb_desync_mitigation_modeelb_classic_lb_multiple_az_configuredelb_classic_lb_use_ssl_certificateelb_classic_lb_use_tls_https_listenerselb_classic_lb_with_outbound_ruleelb_listener_use_secure_ssl_cipheremr_cluster_kerberos_enabledemr_cluster_master_nodes_no_public_ipes_domain_audit_logging_enabledes_domain_cognito_authentication_enabledes_domain_data_nodes_min_3es_domain_dedicated_master_nodes_min_3es_domain_encrypted_using_tls_1_2es_domain_encryption_at_rest_enabledes_domain_error_logging_enabledes_domain_in_vpces_domain_internal_user_database_enabledes_domain_logs_to_cloudwatches_domain_node_to_node_encryption_enabledfsx_file_system_protected_by_backup_planglue_data_catalog_encryption_settings_metadata_encryption_enabledglue_data_catalog_encryption_settings_password_encryption_enabledglue_dev_endpoint_cloudwatch_logs_encryption_enabledglue_dev_endpoint_job_bookmark_encryption_enabledglue_dev_endpoint_s3_encryption_enabledglue_job_bookmarks_encryption_enabledglue_job_cloudwatch_logs_encryption_enabledglue_job_s3_encryption_enabledguardduty_enabledguardduty_finding_archivediam_access_analyzer_enablediam_account_password_policy_expire_90iam_account_password_policy_min_length_14iam_account_password_policy_one_lowercase_letteriam_account_password_policy_one_numberiam_account_password_policy_one_symboliam_account_password_policy_one_uppercase_letteriam_account_password_policy_reuse_24iam_account_password_policy_strongiam_account_password_policy_strong_min_length_8iam_account_password_policy_strong_min_reuse_24iam_group_not_emptyiam_group_user_role_no_inline_policiesiam_policy_all_attached_no_star_stariam_policy_custom_attached_no_star_stariam_policy_custom_no_assume_roleiam_policy_custom_no_blocked_kms_actionsiam_policy_custom_no_service_wildcardiam_policy_custom_no_star_stariam_policy_inline_no_blocked_kms_actionsiam_root_last_usediam_root_user_hardware_mfa_enablediam_root_user_mfa_enablediam_root_user_no_access_keysiam_root_user_virtual_mfaiam_server_certificate_not_expirediam_support_roleiam_user_access_key_age_90iam_user_access_keys_and_password_at_setupiam_user_console_access_mfa_enablediam_user_hardware_mfa_enablediam_user_in_groupiam_user_mfa_enablediam_user_no_inline_attached_policiesiam_user_one_active_keyiam_user_unused_credentials_45iam_user_unused_credentials_90iam_user_with_administrator_access_mfa_enabledkinesis_stream_encrypted_with_kms_cmkkinesis_stream_server_side_encryption_enabledkms_cmk_policy_prohibit_public_accesskms_cmk_rotation_enabledkms_key_decryption_restricted_in_iam_customer_managed_policykms_key_decryption_restricted_in_iam_inline_policykms_key_not_pending_deletionlambda_function_cloudtrail_logging_enabledlambda_function_concurrent_execution_limit_configuredlambda_function_dead_letter_queue_configuredlambda_function_in_vpclambda_function_multiple_az_configuredlambda_function_restrict_public_accesslambda_function_use_latest_runtimelog_group_encryption_at_rest_enabledlog_metric_filter_bucket_policylog_metric_filter_cloudtrail_configurationlog_metric_filter_config_configurationlog_metric_filter_console_authentication_failurelog_metric_filter_console_login_mfalog_metric_filter_disable_or_delete_cmklog_metric_filter_iam_policylog_metric_filter_network_acllog_metric_filter_network_gatewaylog_metric_filter_organizationlog_metric_filter_root_loginlog_metric_filter_route_tablelog_metric_filter_security_grouplog_metric_filter_unauthorized_apilog_metric_filter_vpcmanual_controlnetworkfirewall_firewall_policy_default_stateless_action_check_fragmented_packetsnetworkfirewall_firewall_policy_default_stateless_action_check_full_packetsnetworkfirewall_firewall_policy_rule_group_not_emptynetworkfirewall_stateless_rule_group_not_emptyopensearch_domain_encryption_at_rest_enabledopensearch_domain_fine_grained_access_enabledopensearch_domain_in_vpcrds_db_cluster_aurora_backtracking_enabledrds_db_cluster_aurora_protected_by_backup_planrds_db_cluster_copy_tags_to_snapshot_enabledrds_db_cluster_deletion_protection_enabledrds_db_cluster_events_subscriptionrds_db_cluster_iam_authentication_enabledrds_db_cluster_multiple_az_enabledrds_db_cluster_no_default_admin_namerds_db_instance_and_cluster_enhanced_monitoring_enabledrds_db_instance_and_cluster_no_default_portrds_db_instance_automatic_minor_version_upgrade_enabledrds_db_instance_backup_enabledrds_db_instance_ca_certificate_expires_7_daysrds_db_instance_cloudwatch_logs_enabledrds_db_instance_copy_tags_to_snapshot_enabledrds_db_instance_deletion_protection_enabledrds_db_instance_encryption_at_rest_enabledrds_db_instance_events_subscriptionrds_db_instance_iam_authentication_enabledrds_db_instance_in_backup_planrds_db_instance_in_vpcrds_db_instance_logging_enabledrds_db_instance_multiple_az_enabledrds_db_instance_no_default_admin_namerds_db_instance_prohibit_public_accessrds_db_instance_protected_by_backup_planrds_db_parameter_group_events_subscriptionrds_db_security_group_events_subscriptionrds_db_snapshot_encrypted_at_restrds_db_snapshot_prohibit_public_accessredshift_cluster_automatic_snapshots_min_7_daysredshift_cluster_automatic_upgrade_major_versions_enabledredshift_cluster_encryption_in_transit_enabledredshift_cluster_encryption_logging_enabledredshift_cluster_enhanced_vpc_routing_enabledredshift_cluster_kms_enabledredshift_cluster_logging_enabledredshift_cluster_maintenance_settings_checkredshift_cluster_no_default_admin_nameredshift_cluster_no_default_database_nameredshift_cluster_prohibit_public_accessroute53_domain_transfer_lock_enabledroute53_zone_query_logging_enableds3_bucket_cross_region_replication_enableds3_bucket_default_encryption_enableds3_bucket_default_encryption_enabled_kmss3_bucket_enforces_ssls3_bucket_event_notifications_enableds3_bucket_logging_enableds3_bucket_mfa_delete_enableds3_bucket_object_lock_enableds3_bucket_object_logging_enableds3_bucket_policy_restricts_cross_account_permission_changess3_bucket_public_access_blockeds3_bucket_restrict_public_read_accesss3_bucket_restrict_public_write_accesss3_bucket_versioning_and_lifecycle_policy_enableds3_bucket_versioning_enableds3_public_access_block_accounts3_public_access_block_buckets3_public_access_block_bucket_accountsagemaker_endpoint_configuration_encryption_at_rest_enabledsagemaker_model_in_vpcsagemaker_model_network_isolation_enabledsagemaker_notebook_instance_direct_internet_access_disabledsagemaker_notebook_instance_encryption_at_rest_enabledsagemaker_notebook_instance_in_vpcsagemaker_notebook_instance_root_access_disabledsagemaker_training_job_in_vpcsagemaker_training_job_inter_container_traffic_encryption_enabledsagemaker_training_job_network_isolation_enabledsagemaker_training_job_volume_and_data_encryption_enabledsecretsmanager_secret_automatic_rotation_enabledsecretsmanager_secret_automatic_rotation_lambda_enabledsecretsmanager_secret_encrypted_with_kms_cmksecretsmanager_secret_last_changed_90_daysecretsmanager_secret_last_used_1_daysecretsmanager_secret_rotated_as_scheduledsecretsmanager_secret_unused_90_daysecurityhub_enabledsns_topic_encrypted_at_restsns_topic_notification_delivery_status_enabledsns_topic_policy_prohibit_public_accesssqs_queue_dead_letter_queue_configuredsqs_queue_encrypted_at_restsqs_queue_policy_prohibit_public_accessssm_managed_instance_compliance_association_compliantssm_managed_instance_compliance_patch_compliantvpc_configured_to_use_vpc_endpointsvpc_default_security_group_restricts_all_trafficvpc_eip_associatedvpc_endpoint_service_acceptance_required_enabledvpc_flow_logs_enabledvpc_igw_attached_to_authorized_vpcvpc_network_acl_remote_administrationvpc_network_acl_unusedvpc_route_table_restrict_public_access_to_igwvpc_security_group_allows_ingress_authorized_portsvpc_security_group_associatedvpc_security_group_associated_to_enivpc_security_group_not_uses_launch_wizard_sgvpc_security_group_remote_administrationvpc_security_group_restrict_ingress_common_ports_allvpc_security_group_restrict_ingress_redis_portvpc_security_group_restrict_ingress_ssh_allvpc_security_group_restrict_ingress_tcp_udp_allvpc_security_group_restrict_kibana_portvpc_security_group_restricted_common_portsvpc_security_group_unsuedvpc_subnet_auto_assign_public_ip_disabledvpc_vpn_tunnel_upwaf_rule_condition_attachedwaf_rule_group_rule_attachedwaf_web_acl_rule_attachedwafv2_web_acl_logging_enabled

Query: codebuild_project_source_repo_oauth_configured

Usage

steampipe query aws_compliance.query.codebuild_project_source_repo_oauth_configured

SQL

select
-- Required Columns
p.arn as resource,
case
when p.source ->> 'Type' not in ('GITHUB', 'BITBUCKET') then 'skip'
when c.auth_type = 'OAUTH' then 'ok'
else 'alarm'
end as status,
case
when p.source ->> 'Type' = 'NO_SOURCE' then p.title || ' doesn''t have input source code.'
when p.source ->> 'Type' not in ('GITHUB', 'BITBUCKET') then p.title || ' source code isn''t in GitHub/Bitbucket repository.'
when c.auth_type = 'OAUTH' then p.title || ' using OAuth to connect source repository.'
else p.title || ' not using OAuth to connect source repository.'
end as reason,
-- Additional Dimensions
p.region,
p.account_id
from
aws_codebuild_project as p
left join aws_codebuild_source_credential as c on (p.region = c.region and p.source ->> 'Type' = c.server_type);

Controls

The query is being used by the following controls: