Control: CloudFront response header policy should be configured with Strict Transport Security

powerpipe control run terraform_aws_compliance.control.cloudfront_response_header_use_strict_transport_policy_setting

powerpipe login
powerpipe control run terraform_aws_compliance.control.cloudfront_response_header_use_strict_transport_policy_setting --share

select
  address as resource,
  case
    when (attributes_std -> 'security_headers_config' -> 'strict_transport_security' ->> 'access_control_max_age_sec')::integer = 31536000
    and (attributes_std -> 'security_headers_config' -> 'strict_transport_security' ->> 'include_subdomains')::boolean
    and (attributes_std -> 'security_headers_config' -> 'strict_transport_security' ->> 'preload')::boolean
    and (attributes_std -> 'security_headers_config' -> 'strict_transport_security' ->> 'override')::boolean
    then 'ok'
    else 'alarm'
  end status,
  split_part(address, '.', 2) || case
    when (attributes_std -> 'security_headers_config' -> 'strict_transport_security' ->> 'access_control_max_age_sec')::integer = 31536000
    and (attributes_std -> 'security_headers_config' -> 'strict_transport_security' ->> 'include_subdomains')::boolean
    and (attributes_std -> 'security_headers_config' -> 'strict_transport_security' ->> 'preload')::boolean
    and (attributes_std -> 'security_headers_config' -> 'strict_transport_security' ->> 'override')::boolean then ' enforces Strict Transport Security settings'
    else ' does not enforce Strict Transport Security settings'
  end || '.' as reason
  
  , path || ':' || start_line
from
  terraform_resource
where
  type = 'aws_cloudfront_response_headers_policy';