Control: Backup vaults should exist in a region

powerpipe control run aws_compliance.control.backup_vault_region_configured

powerpipe login
powerpipe control run aws_compliance.control.backup_vault_region_configured --share

with count_vaults as (
  select
    region,
    account_id,
    count(*) as count
  from
    aws_backup_vault
  group by
    region,
    account_id
)
select
  'arn:' || r.partition || '::' || r.region || ':' || r.account_id as resource,
  case
    when v.count > 0 then 'ok'
    else 'alarm'
  end as status,
  case
    when v.count > 0 then v.count || ' backup vault(s) exist in region ' || r.region || '.'
    else 'No backup vault exists in region ' || r.region || '.'
  end as reason
  , r.region, r.account_id
from
  aws_region as r
  left join count_vaults as v on r.account_id = v.account_id and r.region = v.region;