Control: Compute virtual machines should not have a public IP address

powerpipe control run azure_perimeter.control.compute_vm_no_public_ip

powerpipe login
powerpipe control run azure_perimeter.control.compute_vm_no_public_ip --share

select
  vm.id as resource,
  case
    when jsonb_array_length(vm.public_ips) = 0 or vm.public_ips is null then 'ok'
    else 'alarm'
  end as status,
  case
    when jsonb_array_length(vm.public_ips) = 0 or vm.public_ips is null then vm.name || ' does not have public IP addresses.'
    else vm.name || ' has public IP addresses: ' || array_to_string(array(select jsonb_array_elements_text(vm.public_ips)), ', ')
  end as reason
  
  , vm.resource_group as resource_group
  , sub.display_name as subscription
from
  azure_compute_virtual_machine vm,
  azure_subscription sub
where
  sub.subscription_id = vm.subscription_id;