Control: Directory Service directories should only be shared with trusted accounts

powerpipe control run aws_perimeter.control.directory_service_directory_shared_with_trusted_accounts

powerpipe login
powerpipe control run aws_perimeter.control.directory_service_directory_shared_with_trusted_accounts --share

with all_directories as (
  select
    directory_id,
    shared_directories,
    region,
    title,
    _ctx,
    tags,
    account_id
  from
    aws_directory_service_directory
  order by
    account_id,
    region,
    directory_id,
    _ctx,
    tags,
    title
),
directory_data as (
  select
    directory_id,
    to_jsonb(string_to_array(string_agg(sd ->> 'SharedAccountId', ','), ',')) as shared_accounts,
    to_jsonb(string_to_array(string_agg(sd ->> 'SharedAccountId', ','), ',')) - ($1)::text[] as untrusted_accounts,
    region,
    title,
    _ctx,
    tags,
    account_id
  from
    all_directories,
    jsonb_array_elements(shared_directories) sd
  group by
    directory_id,
    region,
    _ctx,
    tags,
    account_id,
    title
),
evaluated_directories as (
  select
    all_directories.*,
    shared_accounts,
    untrusted_accounts
  from
    all_directories
    left join directory_data on all_directories.directory_id = directory_data.directory_id
)
select
  directory_id as resource,
  case
    when shared_accounts is null or jsonb_array_length(shared_accounts) = 0 then 'ok'
    when untrusted_accounts is not null or jsonb_array_length(untrusted_accounts) > 0 then 'info'
    else 'ok'
  end as status,
  case
    when shared_accounts is null or jsonb_array_length(shared_accounts) = 0 then directory_id || ' is not shared.'
    when untrusted_accounts is not null or jsonb_array_length(shared_accounts) > 0 then directory_id || ' shared with ' ||
      case
        when jsonb_array_length(untrusted_accounts) > 2
        then concat('untrusted accounts ' , untrusted_accounts #>> '{0}', ', ', untrusted_accounts #>> '{1}', ' and ' || (jsonb_array_length(untrusted_accounts) - 2)::text || ' more.')
        when jsonb_array_length(untrusted_accounts) = 2 then
        concat('untrusted accounts ', untrusted_accounts #>> '{0}', ' and ', untrusted_accounts #>> '{1}', '.')
        else concat('untrusted account ', untrusted_accounts #>> '{0}', '.')
      end
    else directory_id || ' shared with trusted account(s).'
  end as reason
  
  , region, account_id
from
  evaluated_directories;