Control: SSM managed instance patching should be compliant

powerpipe control run aws_compliance.control.ssm_managed_instance_compliance_patch_compliant

powerpipe login
powerpipe control run aws_compliance.control.ssm_managed_instance_compliance_patch_compliant --share

select
  id as resource,
  case
    when c.status = '' then 'skip'
    when c.status = 'COMPLIANT' then 'ok'
    else 'alarm'
  end as status,
  case
    when c.status = '' then 'Patch is not applicable for instance ' || i.title || '.'
    when c.status = 'COMPLIANT' then c.resource_id || ' patch ' || c.title || ' is compliant.'
    else c.resource_id || ' patch ' || c.title || ' is non-compliant.'
  end as reason
  , c.region, c.account_id
from
  aws_ssm_managed_instance as i,
  aws_ssm_managed_instance_compliance as c
where
  c.resource_id = i.instance_id
  and c.compliance_type = 'Patch';