Control: CloudFront distributions should not use deprecated SSL protocols between edge locations and custom origins

powerpipe control run aws_compliance.control.cloudfront_distribution_no_deprecated_ssl_protocol

powerpipe login
powerpipe control run aws_compliance.control.cloudfront_distribution_no_deprecated_ssl_protocol --share

with origin_ssl_protocols as (
  select
    distinct arn,
    o -> 'CustomOriginConfig' ->> 'OriginProtocolPolicy' as origin_protocol_policy
  from
    aws_cloudfront_distribution,
    jsonb_array_elements(origins) as o
  where
    o -> 'CustomOriginConfig' -> 'OriginSslProtocols' -> 'Items' @> '["SSLv3"]'
)
select
  b.arn as resource,
  case
    when o.arn is null then 'ok'
    else 'alarm'
  end as status,
  case
    when o.arn is null then title || ' does not have deprecated SSL protocols.'
    else title || ' has deprecated SSL protocols.'
  end as reason
  
  , region, account_id
from
  aws_cloudfront_distribution as b
  left join origin_ssl_protocols as o on b.arn = o.arn;