apigateway_rest_api_stage_use_ssl_certificate apigateway_rest_api_stage_xray_tracing_enabled apigateway_stage_cache_encryption_at_rest_enabled apigateway_stage_logging_enabled athena_database_encryption_at_rest_enabled athena_workgroup_encryption_at_rest_enabled autoscaling_group_with_lb_use_health_check autoscaling_launch_config_public_ip_disabled backup_plan_min_retention_35_days cloudfront_distribution_configured_with_origin_failover cloudfront_distribution_default_root_object_configured cloudfront_distribution_encryption_in_transit_enabled cloudfront_distribution_logging_enabled cloudfront_distribution_origin_access_identity_enabled cloudfront_distribution_waf_enabled cloudfront_protocol_version_is_low cloudtrail_enabled_all_regions cloudtrail_trail_logs_encrypted_with_kms_cmk cloudtrail_trail_validation_enabled cloudwatch_alarm_action_enabled cloudwatch_destination_policy_wildcards cloudwatch_log_group_retention_period_365 codebuild_project_encryption_at_rest_enabled codebuild_project_plaintext_env_variables_no_sensitive_aws_values codebuild_project_source_repo_oauth_configured config_aggregator_enabled_all_regions dax_cluster_encryption_at_rest_enabled dms_replication_instance_not_publicly_accessible docdb_cluster_audit_logs_enabled docdb_cluster_encrypted_with_kms dynamodb_table_encrypted_with_kms_cmk dynamodb_table_encryption_enabled dynamodb_table_point_in_time_recovery_enabled dynamodb_vpc_endpoint_routetable_association ebs_attached_volume_encryption_enabled ebs_volume_encryption_at_rest_enabled ec2_classic_lb_connection_draining_enabled ec2_ebs_default_encryption_enabled ec2_instance_detailed_monitoring_enabled ec2_instance_ebs_optimized ec2_instance_not_publicly_accessible ec2_instance_not_use_default_vpc ec2_instance_not_use_multiple_enis ec2_instance_termination_protection_enabled ec2_instance_uses_imdsv2 ecr_repository_encrypted_with_kms ecr_repository_tags_immutable ecr_repository_use_image_scanning ecs_cluster_container_insights_enabled ecs_task_definition_encryption_in_transit_enabled efs_file_system_automatic_backups_enabled efs_file_system_encrypt_data_at_rest eks_cluster_endpoint_restrict_public_access eks_cluster_log_types_enabled eks_cluster_secrets_encrypted elasticache_redis_cluster_automatic_backup_retention_15_days elasticache_replication_group_encryption_in_transit_enabled elb_application_classic_lb_logging_enabled elb_application_lb_deletion_protection_enabled elb_application_lb_drop_http_headers elb_application_lb_waf_enabled elb_classic_lb_cross_zone_load_balancing_enabled elb_classic_lb_use_ssl_certificate elb_classic_lb_use_tls_https_listeners emr_cluster_kerberos_enabled es_domain_audit_logging_enabled es_domain_data_nodes_min_3 es_domain_dedicated_master_nodes_min_3 es_domain_encrypted_using_tls_1_2 es_domain_encryption_at_rest_enabled es_domain_error_logging_enabled es_domain_in_vpc es_domain_logs_to_cloudwatch es_domain_node_to_node_encryption_enabled globalaccelerator_flow_logs_enabled guardduty_enabled iam_account_password_policy_min_length_14 iam_account_password_policy_one_lowercase_letter iam_account_password_policy_one_number iam_account_password_policy_one_symbol iam_account_password_policy_one_uppercase_letter iam_account_password_policy_reuse_24 iam_account_password_policy_strong iam_account_password_policy_strong_min_length_8 iam_password_policy_expire_90 kinesis_stream_encryption_at_rest_enabled kms_cmk_rotation_enabled lambda_function_concurrent_execution_limit_configured lambda_function_dead_letter_queue_configured lambda_function_in_vpc lambda_function_use_latest_runtime lambda_function_xray_tracing_enabled log_group_encryption_at_rest_enabled neptune_cluster_encryption_at_rest_enabled neptune_cluster_logging_enabled rds_db_cluster_aurora_backtracking_enabled rds_db_cluster_copy_tags_to_snapshot_enabled rds_db_cluster_deletion_protection_enabled rds_db_cluster_events_subscription rds_db_cluster_iam_authentication_enabled rds_db_cluster_multiple_az_enabled rds_db_instance_and_cluster_enhanced_monitoring_enabled rds_db_instance_and_cluster_no_default_port rds_db_instance_automatic_minor_version_upgrade_enabled rds_db_instance_backup_enabled rds_db_instance_copy_tags_to_snapshot_enabled rds_db_instance_deletion_protection_enabled rds_db_instance_encryption_at_rest_enabled rds_db_instance_events_subscription rds_db_instance_iam_authentication_enabled rds_db_instance_logging_enabled rds_db_instance_multiple_az_enabled rds_db_instance_prohibit_public_access rds_db_parameter_group_events_subscription rds_db_security_group_events_subscription redshift_cluster_automatic_snapshots_min_7_days redshift_cluster_automatic_upgrade_major_versions_enabled redshift_cluster_deployed_in_ec2_classic_mode redshift_cluster_encryption_logging_enabled redshift_cluster_enhanced_vpc_routing_enabled redshift_cluster_kms_enabled redshift_cluster_logging_enabled redshift_cluster_maintenance_settings_check redshift_cluster_prohibit_public_access s3_bucket_cross_region_replication_enabled s3_bucket_default_encryption_enabled s3_bucket_default_encryption_enabled_kms s3_bucket_logging_enabled s3_bucket_mfa_delete_enabled s3_bucket_object_lock_enabled s3_bucket_public_access_blocked s3_bucket_versioning_enabled s3_public_access_block_account sagemaker_endpoint_configuration_encryption_at_rest_enabled sagemaker_notebook_instance_direct_internet_access_disabled sagemaker_notebook_instance_encryption_at_rest_enabled secretsmanager_secret_automatic_rotation_enabled secretsmanager_secret_automatic_rotation_lambda_enabled secretsmanager_secret_encrypted_with_kms_cmk sns_topic_encrypted_at_rest sqs_queue_encrypted_at_rest sqs_vpc_endpoint_without_dns_resolution vpc_default_security_group_restricts_all_traffic vpc_eip_associated vpc_flow_logs_enabled vpc_igw_attached_to_authorized_vpc vpc_network_acl_unused vpc_security_group_associated_to_eni vpc_security_group_description_for_rules vpc_security_group_rule_description_for_rules vpc_subnet_auto_assign_public_ip_disabled workspace_root_volume_encryption_at_rest_enabled workspace_user_volume_encryption_at_rest_enabled

Query: vpc_security_group_associated_to_eni

Usage

steampipe query terraform_aws_compliance.query.vpc_security_group_associated_to_eni

Plugins & Tables

terraform_resource

Terraform plugin

SQL

select
  type || ' ' || name as resource,
  case
    when name in (
      select
        split_part(
          (
            jsonb_array_elements(arguments -> 'security_groups') :: text
          ),
          '.',
          2
        )
      from
        terraform_resource
      where
        type = 'aws_network_interface'
    ) then 'ok'
    else 'alarm'
  end status,
  name || case
    when name in (
      select
        split_part(
          (
            jsonb_array_elements(arguments -> 'security_groups') :: text
          ),
          '.',
          2
        )
      from
        terraform_resource
      where
        type = 'aws_network_interface'
    ) then ' has attached ENI(s)'
    else ' has no attached ENI(s)'
  end || '.' as reason,
  path || ':' || start_line
from
  terraform_resource
where
  type = 'aws_security_group';

Controls

The query is being used by the following controls:

vpc_security_group_associated_to_eni