fix cloudfront_distribution_use_secure_cipher protocol filter

[sbldevnet]

Issue

The query cloudfront_distribution_use_secure_cipher uses a where clause that does not match with resources that should be correct.

From AWS docs allowed values are SSLv3, TLSv1, TLSv1.1 and TLSv1.2. The chosen value is the minimum SSL protocol that CloudFront uses with the origin. The CustomOriginConfig.OriginSslProtocols.Items value will contain all allowed protocols, so choosing SSLv3 will result in ["SSLv3", "TLSv1", "TLSv1.1", "TLSv1.2"].

Valid origins are those that contain neither SSLv3 nor TLSv1.

CustomOriginConfig.OriginSslProtocols.Items	Expected result
["SSLv3", "TLSv1", "TLSv1.1", "TLSv1.2"]	alarm
["TLSv1", "TLSv1.1", "TLSv1.2"]	alarm
["TLSv1.1", "TLSv1.2"]	ok
["TLSv1.2"]	ok

I have added the distinct statement as a distribution using two or more origins, one with SSLv3 and one with TLSv1, would return two results.

Checklist

• Issue(s) linked

[khushboo9024]

@ sbldevnet Is this really required as we are using distinct in above CTE origin_protocols. ?

[sbldevnet]

@khushboo9024 when there are two or more origins in the same distribution using the SSLv3 and TLSv1 protocols, the CTE origin_protocols returns the same distribution twice.

As the origin_protocols value is not used in the parent query I think it can be removed from the CTE select to avoid using the distinct in the parent query. I tested it locally and seems to work as expected.

[sbldevnet]

Is it OK the current fix or should I remove the origin_protocols from the parent query to avoid the distinct? @khushboo9024

[khushboo9024]

@sbldevnet I am OK with the current fix. 👍