Control: GuardDuty findings should only be shared with trusted accounts

powerpipe control run aws_perimeter.control.guarduty_findings_shared_with_trusted_accounts

powerpipe login
powerpipe control run aws_perimeter.control.guarduty_findings_shared_with_trusted_accounts --share

select
  title as resource,
  case when master_account ->> 'AccountId' is null or (master_account ->> 'AccountId')::text = any (($1)::text[]) then
    'ok'
  else
    'info'
  end as status,
  case when master_account ->> 'AccountId' is null or (master_account ->> 'AccountId')::text = any (($1)::text[]) then
    title || ' findings shared with trusted administrator account.'
  else
    title || ' findings shared with untrusted administrator account ' || (master_account ->> 'AccountId')::text || '.'
  end as reason
  
  , region, account_id
from
  aws_guardduty_detector;