Trigger: Detect & correct Security Hub disabled in regions

select
  concat('[', r.account_id, '/', r.name, ']') as title,
  r.sp_connection_name as conn,
  r.name as region
from
  aws_region as r
  left join aws_securityhub_hub as h on r.account_id = h.account_id
  and r.name = h.region
where
  h.hub_arn is null
  and r.opt_in_status != 'not-opted-in'
  and r.region != any(
    array [ 'af-south-1',
    'eu-south-1',
    'cn-north-1',
    'cn-northwest-1',
    'ap-northeast-3' ]
  );