Query: cosmosdb_account_encryption_report

select
  a.name as "Account Name",
  a.kind as "Kind",
  k.name as "Key Name",
  case
    when a.key_vault_key_uri is null then 'Platform-Managed'
    else 'Customer Managed'
  end as "Encryption Type",
  s.title as "Subscription",
  a.subscription_id as "Subscription ID",
  a.resource_group as "Resource Group",
  a.region as "Region",
  lower(a.id) as "Account ID",
  lower(k.id) as "Key ID"
from
  azure_cosmosdb_account as a
  left join azure_key_vault_key as k on a.key_vault_key_uri = k.key_uri,
  azure_subscription as s
where
  s.subscription_id = a.subscription_id;