Query: cloudfront_distribution_encryption_in_transit_enabled

with cloudfront_distribution as (
  select
    *
  from
    terraform_resource
  where
    type = 'aws_cloudfront_distribution'
),
data as (
  select
    distinct address
  from
    cloudfront_distribution,
    jsonb_array_elements(
      case
        jsonb_typeof(
          attributes_std -> 'ordered_cache_behavior' -> 'Items'
        )
        when 'array' then (
          attributes_std -> 'ordered_cache_behavior' -> 'Items'
        )
        else null
      end
    ) as cb
  where
    cb ->> 'ViewerProtocolPolicy' = 'allow-all'
)
select
  b.address as resource,
  case
    when d.address is not null
    or (
      attributes_std -> 'default_cache_behavior' ->> 'ViewerProtocolPolicy' = 'allow-all'
    ) then 'alarm'
    else 'ok'
  end status,
  split_part(b.address, '.', 2) || case
    when d.address is not null
    or (
      attributes_std -> 'default_cache_behavior' ->> 'ViewerProtocolPolicy' = 'allow-all'
    ) then ' data not encrypted in transit'
    else ' data encrypted in transit'
  end || '.' reason,
  path || ':' || start_line
from
  cloudfront_distribution as b
  left join data as d on b.address = d.address;