Control: RDS DB instances CA certificates should not expire within next 7 days

powerpipe control run aws_compliance.control.rds_db_instance_ca_certificate_expires_7_days

powerpipe login
powerpipe control run aws_compliance.control.rds_db_instance_ca_certificate_expires_7_days --share

select
  arn as resource,
  case
    when extract(day from (to_timestamp(certificate ->> 'ValidTill','YYYY-MM-DDTHH:MI:SS')) - current_timestamp) <= '7' then 'alarm'
    else 'ok'
  end as status,
    title || ' expires ' || to_char(to_timestamp(certificate ->> 'ValidTill','YYYY-MM-DDTHH:MI:SS'), 'DD-Mon-YYYY') ||
    ' (' || extract(day from (to_timestamp(certificate ->> 'ValidTill','YYYY-MM-DDTHH:MI:SS')) - current_timestamp) || ' days).'
  as reason
  
  , region, account_id
from
  aws_rds_db_instance;