Query: eks_cluster_audit_logging_disabled

select
  count(*) as value,
  'Cluster Audit Logging Disabled' as label,
  case
    count(*)
    when 0 then 'ok'
    else 'alert'
  end as "type"
from
  aws_eks_cluster,
  jsonb_array_elements(logging -> 'ClusterLogging') as l,
  jsonb_array_elements_text(l -> 'Types') as t
where
  l -> 'Enabled' = 'false'
  and t = 'audit';