Control: KMS keys should not be pending deletion

powerpipe control run aws_compliance.control.kms_key_not_pending_deletion

powerpipe login
powerpipe control run aws_compliance.control.kms_key_not_pending_deletion --share

select
  arn as resource,
  case
    when key_state = 'PendingDeletion' then 'alarm'
    else 'ok'
  end as status,
  case
    when key_state = 'PendingDeletion' then title || ' scheduled for deletion and will be deleted in ' || extract(day from deletion_date - current_timestamp) || ' day(s).'
    else title || ' not scheduled for deletion.'
  end as reason
  
  , region, account_id
from
  aws_kms_key
where
  key_manager = 'CUSTOMER';