Control: SSM managed instance associations should be compliant

powerpipe control run aws_compliance.control.ssm_managed_instance_compliance_association_compliant

powerpipe login
powerpipe control run aws_compliance.control.ssm_managed_instance_compliance_association_compliant --share

select
  id as resource,
  case
    when c.status = 'COMPLIANT' then 'ok'
    else 'alarm'
  end as status,
  case
    when c.status = 'COMPLIANT' then c.resource_id || ' association ' || c.title || ' is compliant.'
    else c.resource_id || ' association ' || c.title || ' is non-compliant.'
  end as reason

  , c.region, c.account_id
from
  aws_ssm_managed_instance as i,
  aws_ssm_managed_instance_compliance as c
where
  c.resource_id = i.instance_id
  and c.compliance_type = 'Association';