Control: Ensure domains have a CAA record configured to whitelist a CA for issuing certificates

Usage

Run the control in your terminal:

steampipe check net_insights.control.ssl_certificate_caa_record_configured

Snapshot and share results via Steampipe Cloud:

steampipe login
steampipe check --share net_insights.control.ssl_certificate_caa_record_configured

net_dns_record

Params

["github.com","microsoft.com"]

SQL

with domain_list as (
  select
    distinct domain
  from
    net_dns_record
  where
    domain in (
      select
        jsonb_array_elements_text(to_jsonb($1 :: text [ ]))
    )
  order by
    domain
),
domain_with_caa_record as (
  select
    distinct domain
  from
    net_dns_record
  where
    domain in (
      select
        jsonb_array_elements_text(to_jsonb($1 :: text [ ]))
    )
    and type = 'CAA'
)
select
  domain_list.domain as resource,
  case
    when domain_with_caa_record.domain is not null then 'ok'
    else 'alarm'
  end as status,
  case
    when domain_with_caa_record.domain is not null then domain_list.domain || ' has CAA record.'
    else domain_list.domain || ' does not have a CAA record.'
  end as reason
from
  domain_list
  left join domain_with_caa_record on domain_list.domain = domain_with_caa_record.domain
order by
  domain_list.domain;