let acm_certificates = Resources.*[
	Type == "AWS::CertificateManager::Certificate"
]

rule acm_certificate_transparency_logging when %acm_certificates !empty {
	%acm_certificates {
		Properties {
			CertificateTransparencyLoggingPreference !exists <<Transparency logging is disabled.>> OR
			when CertificateTransparencyLoggingPreference exists {
				CertificateTransparencyLoggingPreference == "ENABLED" <<Transparency logging is disabled.>>
			}
		}
	}
}