Control: ELB application load balancers should have Web Application Firewall (WAF) enabled

powerpipe control run aws_compliance.control.elb_application_lb_waf_enabled

powerpipe login
powerpipe control run aws_compliance.control.elb_application_lb_waf_enabled --share

select
  alb.arn as resource,
  case
    when waf.web_acl_id is not null or wafv2.id is not null then 'ok'
    else 'alarm'
  end as status,
    case
    when waf.web_acl_id is not null or wafv2.id is not null then alb.title || ' WAF enabled.'
    else alb.title || ' WAF disabled.'
  end as reason
  
  , alb.region, alb.account_id
from aws_ec2_application_load_balancer as alb
left join aws_wafregional_web_acl as waf on waf.resources @> jsonb_build_array(alb.arn)
left join aws_wafv2_web_acl as wafv2 on wafv2.associated_resources @> jsonb_build_array(alb.arn)