Control: RSA certificates managed by ACM should use a key length of at least 2,048 bits

powerpipe control run aws_compliance.control.acm_certificate_rsa_key_length_2048_bits_or_greater

powerpipe login
powerpipe control run aws_compliance.control.acm_certificate_rsa_key_length_2048_bits_or_greater --share

select
  certificate_arn as resource,
  case
    when not key_algorithm like 'RSA-%' then 'skip'
    when key_algorithm = 'RSA_1024' then 'alarm'
    else 'ok'
  end as status,
  case
    when not key_algorithm like 'RSA-%' then title || ' is not a RSA certificate.'
    when key_algorithm = 'RSA_1024' then title || ' is using 1024 bits key length.'
    else title || ' is using ' || split_part(key_algorithm, '-', 2) || ' bits key length.'
  end as reason
  
  , region, account_id
from
  aws_acm_certificate;