Control: S3 buckets should have lifecycle policies configured

powerpipe control run aws_compliance.control.s3_bucket_lifecycle_policy_enabled

powerpipe login
powerpipe control run aws_compliance.control.s3_bucket_lifecycle_policy_enabled --share

with lifecycle_rules_enabled as (
  select
    arn
  from
    aws_s3_bucket,
    jsonb_array_elements(lifecycle_rules) as r
  where
    r ->> 'Status' = 'Enabled'
)
select
  b.arn as resource,
  case
    when r.arn is not null then 'ok'
    else 'alarm'
  end status,
  case
    when r.arn is not null then name || ' lifecycle policy or rules configured.'
    else name || ' lifecycle policy or rules not configured.'
  end reason
  
  , b.region, b.account_id
from
  aws_s3_bucket as b
  left join lifecycle_rules_enabled as r on r.arn = b.arn;