Control: KMS key should be in use

powerpipe control run aws_compliance.control.kms_cmk_unused

powerpipe login
powerpipe control run aws_compliance.control.kms_cmk_unused --share

select
  arn as resource,
  case
    when not enabled and key_state = 'PendingDeletion' then 'ok'
    when not enabled and key_state <> 'PendingDeletion' then 'alarm'
    else 'ok'
  end as status,
  case
    when not enabled and key_state = 'PendingDeletion' then title || ' scheduled for deletion in ' || extract(day from deletion_date - current_timestamp) || ' day(s).'
    when not enabled and key_state <> 'PendingDeletion' then title || ' is unused.'
    else title || ' is in use.'
  end as reason
  
  , region, account_id
from
  aws_kms_key
where
  key_manager = 'CUSTOMER';