Control: GuardDuty findings should only be shared with trusted accounts

powerpipe control run aws_perimeter.control.guarduty_findings_shared_with_trusted_accounts

powerpipe login
powerpipe control run aws_perimeter.control.guarduty_findings_shared_with_trusted_accounts --share

select
  title as resource,
  case
    when master_account ->> 'AccountId' is null
    or (master_account ->> 'AccountId') :: text = any (($1) :: text [ ]) then 'ok'
    else 'info'
  end as status,
  case
    when master_account ->> 'AccountId' is null
    or (master_account ->> 'AccountId') :: text = any (($1) :: text [ ]) then title || ' findings shared with trusted administrator account.'
    else title || ' findings shared with untrusted administrator account ' || (master_account ->> 'AccountId') :: text || '.'
  end as reason,
  region,
  account_id
from
  aws_guardduty_detector;