Control: Ensure that ACM certificates are not in failed state

powerpipe control run aws_compliance.control.acm_certificate_no_failed_certificate

powerpipe login
powerpipe control run aws_compliance.control.acm_certificate_no_failed_certificate --share

select
  certificate_arn as resource,
  case
    when status in ('VALIDATION_TIMED_OUT', 'FAILED') then 'alarm'
    else 'ok'
  end as status,
  title || ' status is ' || status || '.'  as reason
  
  , region, account_id
from
  aws_acm_certificate;