steampipe plugin install awssteampipe plugin install aws

Table: aws_cloudfront_distribution

AWS CloudFront is a web service that speeds up distribution of your static and dynamic web content, such as .html, .css, .js, and image files, to your users.

Examples

Basic info

select
  id,
  arn,
  status,
  domain_name,
  enabled,
  e_tag,
  http_version,
  is_ipv6_enabled
from
  aws_cloudfront_distribution;

List distributions with logging disabled

select
  id,
  logging ->> 'Bucket' as bucket,
  logging ->> 'Enabled' as logging_enabled,
  logging ->> 'IncludeCookies' as include_cookies
from
  aws_cloudfront_distribution
where
  logging ->> 'Enabled' = 'false';

List distributions with IPv6 DNS requests not enabled

select
  id,
  arn,
  status,
  is_ipv6_enabled
from
  aws_cloudfront_distribution
where
  is_ipv6_enabled = 'false';

List distributions that enforce field-level encryption

select
  id,
  arn,
  default_cache_behavior ->> 'FieldLevelEncryptionId' as field_level_encryption_id,
  default_cache_behavior ->> 'DefaultTTL' as default_ttl
from
  aws_cloudfront_distribution
where
  default_cache_behavior ->> 'FieldLevelEncryptionId' <> '';

List distributions whose origins use encrypted traffic

select
  id,
  arn,
  p -> 'CustomOriginConfig' -> 'HTTPPort' as http_port,
  p -> 'CustomOriginConfig' -> 'HTTPSPort' as https_port,
  p -> 'CustomOriginConfig' -> 'OriginKeepaliveTimeout' as origin_keepalive_timeout,
  p -> 'CustomOriginConfig' -> 'OriginProtocolPolicy' as origin_protocol_policy
from
  aws_cloudfront_distribution,
  jsonb_array_elements(origins) as p
where
  p -> 'CustomOriginConfig' ->> 'OriginProtocolPolicy' = 'https-only';

List distributions whose origins use insecure SSL protocols

select
  id,
  arn,
  p -> 'CustomOriginConfig' -> 'OriginSslProtocols' -> 'Items' as items,
  p -> 'CustomOriginConfig' -> 'OriginSslProtocols' -> 'Quantity' as quantity
from
  aws_cloudfront_distribution,
  jsonb_array_elements(origins) as p
where
  p -> 'CustomOriginConfig' -> 'OriginSslProtocols' -> 'Items' ? & array [ 'SSLv3' ];

Query examples

Control examples

.inspect aws_cloudfront_distribution

AWS CloudFront Distribution

Name	Type	Description
_ctx	jsonb	Steampipe context in JSON form, e.g. connection_name.
account_id	text	The AWS Account ID in which the resource is located.
active_trusted_key_groups	jsonb	CloudFront automatically adds this field to the response if you’ve configured a cache behavior in this distribution to serve private content using key groups.
active_trusted_signers	jsonb	A list of AWS accounts and the identifiers of active CloudFront key pairs in each account that CloudFront can use to verify the signatures of signed URLs and signed cookies.
akas	jsonb	Array of globally unique identifier strings (also known as) for the resource.
alias_icp_recordals	jsonb	AWS services in China customers must file for an Internet Content Provider (ICP) recordal if they want to serve content publicly on an alternate domain name, also known as a CNAME, that they've added to CloudFront. AliasICPRecordal provides the ICP recordal status for CNAMEs associated with distributions.
aliases	jsonb	A complex type that contains information about CNAMEs (alternate domain names),if any, for this distribution.
arn	text	The ARN (Amazon Resource Name) for the distribution.
cache_behaviors	jsonb	The number of cache behaviors for this Distribution.
caller_reference	text	A unique value that ensures that the request can't be replayed.
comment	text	The comment originally specified when this Distribution was created.
custom_error_responses	jsonb	A complex type that contains zero or more CustomErrorResponses elements.
default_cache_behavior	jsonb	A complex type that describes the default cache behavior if you don't specify a CacheBehavior element or if files don't match any of the values of PathPattern in CacheBehavior elements. You must create exactly one default cache behavior.
default_root_object	text	The object that you want CloudFront to request from your origin.
domain_name	text	The domain name that corresponds to the Distribution.
e_tag	text	The current version of the configuration.
enabled	boolean	Whether the Distribution is enabled to accept user requests for content.
http_version	text	Specify the maximum HTTP version that you want viewers to use to communicate with CloudFront. The default value for new web Distributions is http2. Viewers that don't support HTTP/2 will automatically use an earlier version.
id	text	The identifier for the Distribution.
in_progress_invalidation_batches	bigint	The number of invalidation batches currently in progress.
is_ipv6_enabled	boolean	Whether CloudFront responds to IPv6 DNS requests with an IPv6 address for your Distribution.
last_modified_time	timestamp with time zone	The date and time the Distribution was last modified.
logging	jsonb	A complex type that controls whether access logs are written for the distribution.
origin_groups	jsonb	A complex type that contains information about origin groups for this distribution.
origins	jsonb	A complex type that contains information about origins for this distribution.
partition	text	The AWS partition in which the resource is located (aws, aws-cn, or aws-us-gov).
price_class	text	A complex type that contains information about price class for this streaming Distribution.
region	text	The AWS Region in which the resource is located.
restrictions	jsonb	A complex type that identifies ways in which you want to restrict distribution of your content.
status	text	The current status of the Distribution.
tags	jsonb	A map of tags for the resource.
tags_src	jsonb	A list of tags assigned to the Maintenance Window
title	text	Title of the resource.
viewer_certificate	jsonb	A complex type that determines the distribution's SSL/TLS configuration for communicating with viewers.
web_acl_id	text	The Web ACL Id (if any) associated with the distribution.

turbot/aws