Control: Check if service account keys are older than 100 days

powerpipe control run gcp_compliance.control.iam_restrict_service_account_key_age_one_hundred_days

powerpipe login
powerpipe control run gcp_compliance.control.iam_restrict_service_account_key_age_one_hundred_days --share

  select
    'https://iam.googleapis.com/v1/projects/' || project || '/serviceAccounts/' || service_account_name || '/keys/' || name as resource,
  case
    when valid_after_time <= (current_date - interval '100' day) then 'alarm'
    else 'ok'
  end as status,
  service_account_name || ' ' || name || ' created ' || to_char(valid_after_time , 'DD-Mon-YYYY') ||
    ' (' || extract(day from current_timestamp - valid_after_time) || ' days).'
  as reason
  , project as project
from
  gcp_service_account_key;