Control: GuardDuty Detector should be centrally configured

powerpipe control run aws_compliance.control.guardduty_centrally_configured

powerpipe login
powerpipe control run aws_compliance.control.guardduty_centrally_configured --share

select
  'arn:' || r.partition || '::' || r.region || ':' || r.account_id as resource,
  case
    -- Skip if region is is not available in the current connection configuration (i.e., not available to Steampipe)
    when r.steampipe_available = false then 'skip'
    when r.region = any(array['af-south-1', 'ap-northeast-3', 'ap-southeast-3', 'eu-south-1', 'cn-north-1', 'cn-northwest-1', 'me-south-1', 'us-gov-east-1']) then 'skip'
    when r.opt_in_status = 'not-opted-in' then 'skip'
    when d.status is null then 'info'
    when d.status = 'DISABLED' then 'alarm'
    when d.status = 'ENABLED' and d.master_account ->> 'AccountId' is not null then 'ok'
    else 'alarm'
  end as status,
  case
    when r.steampipe_available = false then r.region || ' is not available in the current connection configuration.'
    when r.region = any(array['af-south-1', 'ap-northeast-3', 'ap-southeast-3', 'eu-south-1', 'cn-north-1', 'cn-northwest-1', 'me-south-1', 'us-gov-east-1']) then r.region || ' region not supported.'
    when r.opt_in_status = 'not-opted-in' then r.region || ' region is disabled.'
    when d.status is null then 'No GuardDuty detector found in ' || r.region || '.'
    when d.status = 'DISABLED' then r.region || ' detector ' || d.title || ' disabled.'
    when d.status = 'ENABLED' and d.master_account ->> 'AccountId' is not null then r.region || ' detector ' || d.title || ' centrally configured.'
    else r.region || ' detector ' || d.title || ' not centrally configured.'
  end as reason
, r.region, r.account_id
from
  aws_region as r
  left join aws_guardduty_detector d on r.account_id = d.account_id and r.name = d.region;