Control: ECS Task definition should have different Execution Role ARN and Task Role ARN

powerpipe control run terraform_aws_compliance.control.ecs_task_definition_role_check

powerpipe login
powerpipe control run terraform_aws_compliance.control.ecs_task_definition_role_check --share

select
  address as resource,
  case
    when (attributes_std ->> 'execution_role_arn') is null then 'skip'
    when (attributes_std ->> 'task_role_arn') is null then 'skip'
    when (attributes_std ->> 'execution_role_arn') is not null and (attributes_std ->> 'task_role_arn') is not null and (attributes_std ->> 'execution_role_arn') <> (attributes_std ->> 'task_role_arn') then 'ok'
    else 'alarm'
  end status,
  split_part(address, '.', 2) || case
    when (attributes_std ->> 'execution_role_arn') is null then ' execution_role_arn not set'
    when (attributes_std ->> 'task_role_arn') is null then ' task_role_arn not set'
    when (attributes_std ->> 'execution_role_arn') is not null and (attributes_std ->> 'task_role_arn') is not null and (attributes_std ->> 'execution_role_arn') <> (attributes_std ->> 'task_role_arn') then ' execution_role_arn and task_role_arn are different'
    else ' execution_role_arn and task_role_arn are the same'
  end || '.' reason
  
  , path || ':' || start_line
from
  terraform_resource
where
  type = 'aws_ecs_task_definition';