Query: cloudfront_distribution_waf_status

select
  case when web_acl_id = '' then 'disabled' else 'enabled' end as waf_status,
  count(*)
from
  aws_cloudfront_distribution
group by
  waf_status
order by
  waf_status;