steampipe plugin install awssteampipe plugin install aws

Table: aws_codeartifact_domain

A domain contains one or more repositories. All assets and metadata in a domain's repositories are encrypted with one customer master key (CMK) stored in AWS Key Management Service (AWS KMS).

Examples

Basic info

select
  arn,
  created_time,
  encryption_key,
  status,
  owner,
  tags
from
  aws_codeartifact_domain;

List unencrypted domains

select
  arn,
  created_time,
  status,
  s3_bucket_arn,
  tags
from
  aws_codeartifact_domain
where
  encryption_key is null;

List inactive domains

select
  arn,
  created_time,
  status,
  s3_bucket_arn,
  tags
from
  aws_codeartifact_domain
where
  status != 'Active';

List domain policy statements that grant external access

select
  arn,
  p as principal,
  a as action,
  s ->> 'Effect' as effect
from
  aws_codeartifact_domain,
  jsonb_array_elements(policy_std -> 'Statement') as s,
  jsonb_array_elements_text(s -> 'Principal' -> 'AWS') as p,
  string_to_array(p, ':') as pa,
  jsonb_array_elements_text(s -> 'Action') as a
where
  s ->> 'Effect' = 'Allow'
  and (
    pa [ 5 ] != account_id
    or p = '*'
  );

Get S3 bucket details associated with each domain

select
  d.arn as domain_arn,
  b.arn as bucket_arn,
  d.encryption_key domain_encryption_key,
  bucket_policy_is_public
from
  aws_codeartifact_domain d
  join aws_s3_bucket b on d.s3_bucket_arn = b.arn;

Get KMS key details associated with each the domain

select
  d.arn as domain_arn,
  d.encryption_key domain_encryption_key,
  key_manager,
  key_state
from
  aws_codeartifact_domain d
  join aws_kms_key k on d.encryption_key = k.arn;

List domains using customer managed encryption

select
  d.arn as domain_arn,
  d.encryption_key domain_encryption_key,
  key_manager,
  key_state
from
  aws_codeartifact_domain d
  join aws_kms_key k on d.encryption_key = k.arn
where
  key_manager = 'CUSTOMER';

.inspect aws_codeartifact_domain

AWS Code Artifact Domain

Name	Type	Description
_ctx	jsonb	Steampipe context in JSON form, e.g. connection_name.
account_id	text	The AWS Account ID in which the resource is located.
akas	jsonb	Array of globally unique identifier strings (also known as) for the resource.
arn	text	The Amazon Resource Name (ARN) specifying the domain.
asset_size_bytes	bigint	The total size of all assets in the domain.
created_time	timestamp with time zone	A timestamp that contains the date and time the domain was created.
encryption_key	text	The key used to encrypt the domain.
name	text	The name of the domain.
owner	text	The 12-digit account number of the Amazon Web Services account that owns the domain. It does not include dashes or spaces.
partition	text	The AWS partition in which the resource is located (aws, aws-cn, or aws-us-gov).
policy	jsonb	An CodeArtifact resource policy that contains a resource ARN, document details, and a revision.
policy_std	jsonb	Contains the contents of the resource-based policy in a canonical form for easier searching.
region	text	The AWS Region in which the resource is located.
repository_count	bigint	The number of repositories in the domain.
s3_bucket_arn	text	The Amazon Resource Name (ARN) of the Amazon S3 bucket that is used to store package assets in the domain.
status	text	A string that contains the status of the domain.
tags	jsonb	A map of tags for the resource.
tags_src	jsonb	A list of tags assigned to the resource.
title	text	Title of the resource.

turbot/aws