steampipe plugin install awssteampipe plugin install aws

Table: aws_backup_framework

AWS Backup framework is a collection of controls that you can use to evaluate your backup practices. The AWS Backup framework will then evaluate whether your backup practices comply with your policies and highlight which resources are not yet in compliance.

Examples

Basic info

select
  account_id,
  arn,
  creation_time,
  deployment_status,
  framework_controls,
  framework_description,
  framework_name,
  framework_status,
  number_of_controls,
  region,
  tags
from
  aws_backup_framework;

List AWS frameworks created within the last 90 days

select
  framework_name,
  arn,
  creation_time,
  number_of_controls
from
  aws_backup_framework
where
  creation_time >= (current_date - interval '90' day)
order by
  creation_time;

List frameworks that are using a specific control (`BACKUP_RESOURCES_PROTECTED_BY_BACKUP_VAULT_LOCK`)

select
  framework_name
from
  aws_backup_framework,
  jsonb_array_elements(framework_controls) as controls
where
  controls ->> 'ControlName' = 'BACKUP_RESOURCES_PROTECTED_BY_BACKUP_VAULT_LOCK';

List control names and scopes for each framework

This query will return an empty control scope if the control doesn't apply to a specific AWS resource type. Otherwise, the query will list the control name and the AWS resource type.

select
  framework_name,
  controls ->> 'ControlName' as control_name,
  control_scope
from
  aws_backup_framework,
  jsonb_array_elements(framework_controls) as controls,
  json_array_elements_text(
    coalesce(
      controls -> 'ControlScope' ->> 'ComplianceResourceTypes',
      '[""]'
    ) :: json
  ) as control_scope
where
  framework_name = 'framework_name';

List framework controls that have non-compliant resources

select
  rule_name,
  compliance_result -> 'Compliance' ->> 'ComplianceType' as compliance_type,
  compliance_result -> 'Compliance' -> 'ComplianceContributorCount' ->> 'CappedCount' as count_of_noncompliant_resources
from
  aws_config_rule
  inner join (
    -- The sub-query will create the AWS Config rule name from information stored in the AWS Backup framework table.
    select
      case
        when framework_information.control_scope = '' then concat(
          framework_information.control_name,
          '-',
          framework_information.framework_uuid
        )
        else concat(
          upper(framework_information.control_scope),
          '-',
          framework_information.control_name,
          '-',
          framework_information.framework_uuid
        )
      end as rule_name
    from
      (
        select
          framework_name,
          controls ->> 'ControlName' as control_name,
          control_scope,
          right(arn, 36) as framework_uuid
        from
          aws_backup_framework,
          jsonb_array_elements(framework_controls) as controls,
          json_array_elements_text(
            coalesce(
              controls -> 'ControlScope' ->> 'ComplianceResourceTypes',
              '[""]'
            ) :: json
          ) as control_scope
      ) as framework_information
  ) as backup_framework on aws_config_rule.name = backup_framework.rule_name,
  jsonb_array_elements(compliance_by_config_rule) as compliance_result
where
  compliance_result -> 'Compliance' ->> 'ComplianceType' = 'NON_COMPLIANT';

List framework controls that are compliant

select
  rule_name,
  compliance_result -> 'Compliance' ->> 'ComplianceType' as compliance_type
from
  aws_config_rule
  inner join (
    -- The sub-query will create the AWS Config rule name from information stored in the AWS Backup framework table.
    select
      case
        when framework_information.control_scope = '' then concat(
          framework_information.control_name,
          '-',
          framework_information.framework_uuid
        )
        else concat(
          upper(framework_information.control_scope),
          '-',
          framework_information.control_name,
          '-',
          framework_information.framework_uuid
        )
      end as rule_name
    from
      (
        select
          framework_name,
          controls ->> 'ControlName' as control_name,
          control_scope,
          right(arn, 36) as framework_uuid
        from
          aws_backup_framework,
          jsonb_array_elements(framework_controls) as controls,
          json_array_elements_text(
            coalesce(
              controls -> 'ControlScope' ->> 'ComplianceResourceTypes',
              '[""]'
            ) :: json
          ) as control_scope
      ) as framework_information
  ) as backup_framework on aws_config_rule.name = backup_framework.rule_name,
  jsonb_array_elements(compliance_by_config_rule) as compliance_result
where
  compliance_result -> 'Compliance' ->> 'ComplianceType' = 'COMPLIANT';

.inspect aws_backup_framework

AWS Backup Framework

Name	Type	Description
_ctx	jsonb	Steampipe context in JSON form, e.g. connection_name.
account_id	text	The AWS Account ID in which the resource is located.
akas	jsonb	Array of globally unique identifier strings (also known as) for the resource.
arn	text	An Amazon Resource Name (ARN) that uniquely identifies a backup framework resource.
creation_time	timestamp with time zone	The date and time that a framework was created.
deployment_status	text	The deployment status of a backup framework.
framework_controls	jsonb	A list of the controls that make up the framework. Each control in the list has a name, input parameters, and scope.
framework_description	text	An optional description of the backup framework.
framework_name	text	The unique name of a backup framework.
framework_status	text	The framework status based on recording statuses for resources governed by the framework (ACTIVE \| PARTIALLY_ACTIVE \| INACTIVE \| UNAVAILABLE).
number_of_controls	bigint	The number of controls contained by the framework.
partition	text	The AWS partition in which the resource is located (aws, aws-cn, or aws-us-gov).
region	text	The AWS Region in which the resource is located.
tags	jsonb	A map of tags for the resource.
title	text	Title of the resource.

turbot/aws

Table: aws_backup_framework

Examples

Basic info

List AWS frameworks created within the last 90 days

List frameworks that are using a specific control (`BACKUP_RESOURCES_PROTECTED_BY_BACKUP_VAULT_LOCK`)

List control names and scopes for each framework

List framework controls that have non-compliant resources

List framework controls that are compliant

.inspect aws_backup_framework

Steampipe

Resources

Community

turbot/aws

Table: aws_backup_framework

Examples

Basic info

List AWS frameworks created within the last 90 days

List frameworks that are using a specific control (BACKUP_RESOURCES_PROTECTED_BY_BACKUP_VAULT_LOCK)

List control names and scopes for each framework

List framework controls that have non-compliant resources

List framework controls that are compliant

.inspect aws_backup_framework

List frameworks that are using a specific control (`BACKUP_RESOURCES_PROTECTED_BY_BACKUP_VAULT_LOCK`)