Control: Ensure access to AWSCloudShellFullAccess is restricted

powerpipe control run aws_compliance.control.iam_user_group_role_cloudshell_fullaccess_restricted

powerpipe login
powerpipe control run aws_compliance.control.iam_user_group_role_cloudshell_fullaccess_restricted --share

select
  arn as resource,
  case
    when attached_policy_arns @> '["arn:aws:iam::aws:policy/AWSCloudShellFullAccess"]' then 'alarm'
    else 'ok'
  end status,
  case
    when attached_policy_arns @> '["arn:aws:iam::aws:policy/AWSCloudShellFullAccess"]' then  'User ' || title || ' has access to AWSCloudShellFullAccess.'
    else 'User ' || title || ' access to AWSCloudShellFullAccess is restricted.'
  end as reason
  , account_id
from
  aws_iam_user
union
select
  arn as resource,
  case
    when attached_policy_arns @> '["arn:aws:iam::aws:policy/AWSCloudShellFullAccess"]' then 'alarm'
    else 'ok'
  end status,
  case
    when attached_policy_arns @> '["arn:aws:iam::aws:policy/AWSCloudShellFullAccess"]' then  'Role ' || title || ' has access to AWSCloudShellFullAccess.'
    else 'Role ' || title || ' access to AWSCloudShellFullAccess is restricted.'
  end as reason
  , account_id
from
  aws_iam_role
union
select
  arn as resource,
  case
    when attached_policy_arns @> '["arn:aws:iam::aws:policy/AWSCloudShellFullAccess"]' then 'alarm'
    else 'ok'
  end status,
  case
    when attached_policy_arns @> '["arn:aws:iam::aws:policy/AWSCloudShellFullAccess"]' then  'Group ' || title || ' has access to AWSCloudShellFullAccess.'
    else 'Group ' || title || ' access to AWSCloudShellFullAccess is restricted.'
  end as reason
  , account_id
from
  aws_iam_group;