Control: SSM documents should not be public

powerpipe control run aws_compliance.control.ssm_document_prohibit_public_access

powerpipe login
powerpipe control run aws_compliance.control.ssm_document_prohibit_public_access --share

select
  d.arn as resource,
  case
    when p.account_ids :: jsonb ? 'all' then 'alarm'
    else 'ok'
  end as status,
  case
    when p.account_ids :: jsonb ? 'all' then d.title || ' publicly accessible.'
    else d.title || ' not publicly accessible.'
  end as reason
  
  , d.region, d.account_id
from
  aws_ssm_document as d
  left join aws_ssm_document_permission as p on p.document_name = d.name and p.region = d.region  and p.account_id = d.account_id
where
  d.owner_type = 'Self';