Control: EC2 auto scaling group launch configurations user data should not have any sensitive data

powerpipe control run aws_compliance.control.autoscaling_ec2_launch_configuration_no_sensitive_data

powerpipe login
powerpipe control run aws_compliance.control.autoscaling_ec2_launch_configuration_no_sensitive_data --share

select
  launch_configuration_arn as resource,
  case
    when
      user_data like any (array [ '%pass%', '%secret%', '%token%', '%key%' ])
      or user_data ~ '(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[@$!%*?&])[A-Za-z\d@$!%*?&]' then 'alarm'
    else 'ok'
  end as status,
  case
    when
      user_data like any (array [ '%pass%', '%secret%', '%token%', '%key%' ])
      or user_data ~ '(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[@$!%*?&])[A-Za-z\d@$!%*?&]' then title || ' has potential secret patterns in user data.'
    else title || ' does not contain secret patterns in user data.'
  end as reason
  , region, account_id
from
  aws_ec2_launch_configuration;