Control: CloudWatch alarm should have an action configured

powerpipe control run aws_compliance.control.cloudwatch_alarm_action_enabled

powerpipe login
powerpipe control run aws_compliance.control.cloudwatch_alarm_action_enabled --share

select
  arn as resource,
  case
    when jsonb_array_length(alarm_actions) = 0
    and jsonb_array_length(insufficient_data_actions) = 0
    and jsonb_array_length(ok_actions) = 0 then 'alarm'
    else 'ok'
  end as status,
  case
    when jsonb_array_length(alarm_actions) = 0
    and jsonb_array_length(insufficient_data_actions) = 0
    and jsonb_array_length(ok_actions) = 0 then title || ' no action enabled.'
    when jsonb_array_length(alarm_actions) != 0 then title || ' alarm action enabled.'
    when jsonb_array_length(insufficient_data_actions) != 0 then title || ' insufficient data action enabled.'
    when jsonb_array_length(ok_actions) != 0 then title || ' ok action enabled.'
    else 'ok'
  end as reason
  
  , region, account_id
from
  aws_cloudwatch_alarm;