Query: mysql_server_encrypted_at_rest_using_cmk

with mysql_server as (
  select
    *
  from
    terraform_resource
  where
    type = 'azurerm_mysql_server'
),
server_keys as (
  select
    *
  from
    terraform_resource
  where
    type = 'azurerm_mysql_server_key'
    and (attributes_std -> 'key_vault_key_id') is not null
)
select
  a.address as resource,
  case
    when (s.attributes_std ->> 'server_id') is not null then 'ok'
    else 'alarm'
  end as status,
  split_part(a.address, '.', 2) || case
    when (s.attributes_std ->> 'server_id') is not null then ' encrypted with CMK'
    else ' not encrypted with CMK'
  end || '.' reason,
  a.path || ':' || a.start_line
from
  mysql_server as a
  left join server_keys as s on a.name = (
    split_part((s.attributes_std ->> 'server_id'), '.', 2)
  );