From 7690cb5f9816d735b0274cf4cedfb4dfcf2f339a Mon Sep 17 00:00:00 2001
From: Michael Dickinson
 <45626543+michael-dickinson-sainsburys@users.noreply.github.com>
Date: Thu, 23 Dec 2021 12:29:12 +0000
Subject: [PATCH 1/7] New check 7166 Elastic IP addresses with associations are
 protected by AWS Shield Advanced

---
 checks/check_extra7166 | 50 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 50 insertions(+)
 create mode 100644 checks/check_extra7166

diff --git a/checks/check_extra7166 b/checks/check_extra7166
new file mode 100644
index 0000000000..3496238832
--- /dev/null
+++ b/checks/check_extra7166
@@ -0,0 +1,50 @@
+#!/usr/bin/env bash
+
+# Prowler - the handy cloud security tool (copyright 2019) by Toni de la Fuente
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may not
+# use this file except in compliance with the License. You may obtain a copy
+# of the License at http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software distributed
+# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
+# CONDITIONS OF ANY KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations under the License.
+
+CHECK_ID_extra7166="7.166"
+CHECK_TITLE_extra7166="[extra7166] Check if Elastic IP addresses with associations are protected by AWS Shield Advanced"
+CHECK_SCORED_extra7166="NOT_SCORED"
+CHECK_CIS_LEVEL_extra7166="EXTRA"
+CHECK_SEVERITY_check="Medium"
+CHECK_ASFF_RESOURCE_TYPE_extra7166="AwsEc2Eip"
+CHECK_ALTERNATE_extra7166="extra7166"
+CHECK_SERVICENAME_extra7166="shield"
+CHECK_RISK_extra7166='AWS Shield Advanced provides expanded DDoS attack protection for your resources'
+CHECK_REMEDIATION_extra7166='Add as a protected resource in AWS Shield Advanced.'
+CHECK_DOC_extra7166='https://docs.aws.amazon.com/waf/latest/developerguide/configure-new-protection.html'
+CHECK_CAF_EPIC_extra7166='Infrastructure security'
+
+extra7166() {
+  if [[ "$($AWSCLI shield get-subscription-state --output text)" == "ACTIVE" ]]; then
+    CALLER_IDENTITY=$($AWSCLI sts get-caller-identity $PROFILE_OPT --query Arn)
+    PARTITION=$(echo $CALLER_IDENTITY | cut -d: -f2)
+    ACCOUNT_ID=$(echo $CALLER_IDENTITY | cut -d: -f5)
+    for regx in $REGIONS; do
+      LIST_OF_ELASTIC_IPS_WITH_ASSOCIATIONS=$($AWSCLI ec2 describe-addresses $PROFILE_OPT --region $regx --query 'Addresses[?AssociationId].AllocationId' --output text)
+      if [[ $LIST_OF_ELASTIC_IPS_WITH_ASSOCIATIONS ]]; then
+        for elastic_ip in $LIST_OF_ELASTIC_IPS_WITH_ASSOCIATIONS; do
+          EIP_ARN="arn:${PARTITION}:ec2:${regx}:${ACCOUNT_ID}:eip-allocation/${elastic_ip}"
+          if aws shield describe-protection --resource-arn $EIP_ARN >/dev/null 2>&1; then
+            textPass "$regx: EIP $elastic_ip is protected by AWS Shield Advanced" "$regx" "$elastic_ip"
+          else
+            textFail "$regx: EIP $elastic_ip is not protected by AWS Shield Advanced" "$regx" "$elastic_ip"
+          fi
+        done
+      else
+        textPass "$regx: no elastic IP addresses with assocations found" "$regx"
+      fi
+    done
+  else
+    textInfo "No AWS Shield Advanced subscription found. Skipping check."
+  fi
+}

From 4aa4c95d22a865fe07430559dd95012352a680a1 Mon Sep 17 00:00:00 2001
From: Michael Dickinson
 <45626543+michael-dickinson-sainsburys@users.noreply.github.com>
Date: Thu, 23 Dec 2021 12:49:37 +0000
Subject: [PATCH 2/7] New check 7167 Cloudfront distributions are protected by
 AWS Shield Advanced

---
 checks/check_extra7167 | 46 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 46 insertions(+)
 create mode 100644 checks/check_extra7167

diff --git a/checks/check_extra7167 b/checks/check_extra7167
new file mode 100644
index 0000000000..5bdcefed86
--- /dev/null
+++ b/checks/check_extra7167
@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+
+# Prowler - the handy cloud security tool (copyright 2019) by Toni de la Fuente
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may not
+# use this file except in compliance with the License. You may obtain a copy
+# of the License at http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software distributed
+# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
+# CONDITIONS OF ANY KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations under the License.
+
+CHECK_ID_extra7167="7.167"
+CHECK_TITLE_extra7167="[extra7167] Check if Cloudfront distributions are protected by AWS Shield"
+CHECK_SCORED_extra7167="NOT_SCORED"
+CHECK_CIS_LEVEL_extra7167="EXTRA"
+CHECK_SEVERITY_check="Medium"
+CHECK_ASFF_RESOURCE_TYPE_extra7167="AwsCloudFrontDistribution"
+CHECK_ALTERNATE_extra7167="extra7167"
+CHECK_SERVICENAME_extra7167="shield"
+CHECK_RISK_extra7167='AWS Shield Advanced provides expanded DDoS attack protection for your resources'
+CHECK_REMEDIATION_extra7167='Add as a protected resource in AWS Shield Advanced.'
+CHECK_DOC_extra7167='https://docs.aws.amazon.com/waf/latest/developerguide/configure-new-protection.html'
+CHECK_CAF_EPIC_extra7167='Infrastructure security'
+
+extra7167() {
+  if [[ "$($AWSCLI shield get-subscription-state --output text)" == "ACTIVE" ]]; then
+    LIST_OF_CLOUDFRONT_DISTRIBUTIONS=$($AWSCLI cloudfront list-distributions $PROFILE_OPT --query 'DistributionList.Items[*].[Id,ARN]' --output text)
+    if [[ $LIST_OF_CLOUDFRONT_DISTRIBUTIONS ]]; then
+      while read -r distribution; do
+        DISTRIBUTION_ID=$(echo $distribution | awk '{ print $1; }')
+        DISTRIBUTION_ARN=$(echo $distribution | awk '{ print $2; }')
+        if aws shield describe-protection --resource-arn $DISTRIBUTION_ARN >/dev/null 2>&1; then
+          textPass "$REGION: Cloudfront distribution $DISTRIBUTION_ID is protected by AWS Shield Advanced" "$REGION" "$DISTRIBUTION_ID"
+        else
+          textFail "$REGION: Cloudfront distribution $DISTRIBUTION_ID is not protected by AWS Shield Advanced" "$REGION" "$DISTRIBUTION_ID"
+        fi
+      done <<<"$LIST_OF_CLOUDFRONT_DISTRIBUTIONS"
+    else
+      textPass "$REGION: no Cloudfront distributions found" "$REGION"
+    fi
+  else
+    textInfo "No AWS Shield Advanced subscription found. Skipping check."
+  fi
+}

From 122e1c0cf8b36a43d93e79ff2ceaf85336e534ff Mon Sep 17 00:00:00 2001
From: Michael Dickinson
 <45626543+michael-dickinson-sainsburys@users.noreply.github.com>
Date: Thu, 23 Dec 2021 13:08:12 +0000
Subject: [PATCH 3/7] New check 7168 Route53 hosted zones are protected by AWS
 Shield Advanced

---
 checks/check_extra7168 | 49 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 49 insertions(+)
 create mode 100644 checks/check_extra7168

diff --git a/checks/check_extra7168 b/checks/check_extra7168
new file mode 100644
index 0000000000..67f9901235
--- /dev/null
+++ b/checks/check_extra7168
@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+
+# Prowler - the handy cloud security tool (copyright 2019) by Toni de la Fuente
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may not
+# use this file except in compliance with the License. You may obtain a copy
+# of the License at http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software distributed
+# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
+# CONDITIONS OF ANY KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations under the License.
+
+CHECK_ID_extra7168="7.168"
+CHECK_TITLE_extra7168="[extra7168] Check if Route53 hosted zones are protected by AWS Shield"
+CHECK_SCORED_extra7168="NOT_SCORED"
+CHECK_CIS_LEVEL_extra7168="EXTRA"
+CHECK_SEVERITY_check="Medium"
+CHECK_ASFF_RESOURCE_TYPE_extra7168="AwsRoute53Domain"
+CHECK_ALTERNATE_extra7168="extra7168"
+CHECK_SERVICENAME_extra7168="shield"
+CHECK_RISK_extra7168='AWS Shield Advanced provides expanded DDoS attack protection for your resources'
+CHECK_REMEDIATION_extra7168='Add as a protected resource in AWS Shield Advanced.'
+CHECK_DOC_extra7168='https://docs.aws.amazon.com/waf/latest/developerguide/configure-new-protection.html'
+CHECK_CAF_EPIC_extra7168='Infrastructure security'
+
+extra7168() {
+  if [[ "$($AWSCLI shield get-subscription-state --output text)" == "ACTIVE" ]]; then
+    CALLER_IDENTITY=$($AWSCLI sts get-caller-identity $PROFILE_OPT --query Arn)
+    PARTITION=$(echo $CALLER_IDENTITY | cut -d: -f2)
+    LIST_OF_ROUTE53_HOSTED_ZONES=$($AWSCLI route53 list-hosted-zones $PROFILE_OPT --query 'HostedZones[*].[Id,Name]' --output text)
+    if [[ $LIST_OF_ROUTE53_HOSTED_ZONES ]]; then
+      while read -r hosted_zone; do
+        HOSTED_ZONE_ID=$(echo $hosted_zone | awk '{ print $1; }')
+        HOSTED_ZONE_NAME=$(echo $hosted_zone | awk '{ print $2; }')
+        HOSTED_ZONE_ARN="arn:${PARTITION}:route53:::${HOSTED_ZONE_ID:1}"
+        if aws shield describe-protection --resource-arn $HOSTED_ZONE_ARN >/dev/null 2>&1; then
+          textPass "$REGION: Route53 Hosted Zone $HOSTED_ZONE_NAME is protected by AWS Shield Advanced" "$REGION" "$HOSTED_ZONE_NAME"
+        else
+          textFail "$REGION: Route53 Hosted Zone $HOSTED_ZONE_NAME is not protected by AWS Shield Advanced" "$REGION" "$HOSTED_ZONE_NAME"
+        fi
+      done <<<"$LIST_OF_ROUTE53_HOSTED_ZONES"
+    else
+      textPass "$REGION: no Route53 hosted zones found" "$REGION"
+    fi
+  else
+    textInfo "No AWS Shield Advanced subscription found. Skipping check."
+  fi
+}

From 472afa5a1f7cde8eb2ff92b0895c9b532687af0a Mon Sep 17 00:00:00 2001
From: Michael Dickinson
 <45626543+michael-dickinson-sainsburys@users.noreply.github.com>
Date: Thu, 23 Dec 2021 14:27:11 +0000
Subject: [PATCH 4/7] New check 7169 Global accelerators are protected by AWS
 Shield Advanced

---
 checks/check_extra7169 | 46 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 46 insertions(+)
 create mode 100644 checks/check_extra7169

diff --git a/checks/check_extra7169 b/checks/check_extra7169
new file mode 100644
index 0000000000..728244ac6d
--- /dev/null
+++ b/checks/check_extra7169
@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+
+# Prowler - the handy cloud security tool (copyright 2019) by Toni de la Fuente
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may not
+# use this file except in compliance with the License. You may obtain a copy
+# of the License at http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software distributed
+# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
+# CONDITIONS OF ANY KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations under the License.
+
+CHECK_ID_extra7169="7.169"
+CHECK_TITLE_extra7169="[extra7169] Check if global accelerators are protected by AWS Shield"
+CHECK_SCORED_extra7169="NOT_SCORED"
+CHECK_CIS_LEVEL_extra7169="EXTRA"
+CHECK_SEVERITY_check="Medium"
+CHECK_ASFF_RESOURCE_TYPE_extra7169="AwsGlobalAccelerator"
+CHECK_ALTERNATE_extra7169="extra7169"
+CHECK_SERVICENAME_extra7169="shield"
+CHECK_RISK_extra7169='AWS Shield Advanced provides expanded DDoS attack protection for your resources'
+CHECK_REMEDIATION_extra7169='Add as a protected resource in AWS Shield Advanced.'
+CHECK_DOC_extra7169='https://docs.aws.amazon.com/waf/latest/developerguide/configure-new-protection.html'
+CHECK_CAF_EPIC_extra7169='Infrastructure security'
+
+extra7169() {
+  if [[ "$($AWSCLI shield get-subscription-state --output text)" == "ACTIVE" ]]; then
+    LIST_OF_GLOBAL_ACCELERATORS=$($AWSCLI globalaccelerator list-accelerators --region us-west-2 $PROFILE_OPT --query 'Accelerators[?Enabled].[Name,AcceleratorArn]' --output text)
+    if [[ $LIST_OF_GLOBAL_ACCELERATORS ]]; then
+      while read -r accelerator; do
+        ACCELERATOR_NAME=$(echo $accelerator | awk '{ print $1; }')
+        ACCELERATOR_ARN=$(echo $accelerator | awk '{ print $2; }')
+        if aws shield describe-protection --resource-arn $ACCELERATOR_ARN >/dev/null 2>&1; then
+          textPass "$REGION: Global Accelerator $ACCELERATOR_NAME is protected by AWS Shield Advanced" "$REGION" "$ACCELERATOR_NAME"
+        else
+          textFail "$REGION: Global Accelerator $ACCELERATOR_NAME is not protected by AWS Shield Advanced" "$REGION" "$ACCELERATOR_NAME"
+        fi
+      done <<<"$LIST_OF_GLOBAL_ACCELERATORS"
+    else
+      textPass "$REGION: no global accelerators found" "$REGION"
+    fi
+  else
+    textInfo "No AWS Shield Advanced subscription found. Skipping check."
+  fi
+}

From ab9e40c4dd2615b3d095f843c29296daeac9c662 Mon Sep 17 00:00:00 2001
From: Michael Dickinson
 <45626543+michael-dickinson-sainsburys@users.noreply.github.com>
Date: Thu, 23 Dec 2021 15:21:40 +0000
Subject: [PATCH 5/7] New check 7170 Application load balancers are protected
 by AWS Shield Advanced

---
 checks/check_extra7170 | 48 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 48 insertions(+)
 create mode 100644 checks/check_extra7170

diff --git a/checks/check_extra7170 b/checks/check_extra7170
new file mode 100644
index 0000000000..190604ddd7
--- /dev/null
+++ b/checks/check_extra7170
@@ -0,0 +1,48 @@
+#!/usr/bin/env bash
+
+# Prowler - the handy cloud security tool (copyright 2019) by Toni de la Fuente
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may not
+# use this file except in compliance with the License. You may obtain a copy
+# of the License at http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software distributed
+# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
+# CONDITIONS OF ANY KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations under the License.
+
+CHECK_ID_extra7170="7.170"
+CHECK_TITLE_extra7170="[extra7170] Check if internet-facing application load balancers are protected by AWS Shield"
+CHECK_SCORED_extra7170="NOT_SCORED"
+CHECK_CIS_LEVEL_extra7170="EXTRA"
+CHECK_SEVERITY_check="Medium"
+CHECK_ASFF_RESOURCE_TYPE_extra7170="AwsElasticLoadBalancingV2LoadBalancer"
+CHECK_ALTERNATE_extra7170="extra7170"
+CHECK_SERVICENAME_extra7170="shield"
+CHECK_RISK_extra7170='AWS Shield Advanced provides expanded DDoS attack protection for your resources'
+CHECK_REMEDIATION_extra7170='Add as a protected resource in AWS Shield Advanced.'
+CHECK_DOC_extra7170='https://docs.aws.amazon.com/waf/latest/developerguide/configure-new-protection.html'
+CHECK_CAF_EPIC_extra7170='Infrastructure security'
+
+extra7170() {
+  if [[ "$($AWSCLI shield get-subscription-state --output text)" == "ACTIVE" ]]; then
+    for regx in $REGIONS; do
+      LIST_OF_APPLICATION_LOAD_BALANCERS=$($AWSCLI elbv2 describe-load-balancers $PROFILE_OPT --region $regx --query 'LoadBalancers[?Type == `application` && Scheme == `internet-facing`].[LoadBalancerName,LoadBalancerArn]' --output text)
+      if [[ $LIST_OF_APPLICATION_LOAD_BALANCERS ]]; then
+        while read -r alb; do
+          ALB_NAME=$(echo $alb | awk '{ print $1; }')
+          ALB_ARN=$(echo $alb | awk '{ print $2; }')
+          if aws shield describe-protection --resource-arn $ALB_ARN >/dev/null 2>&1; then
+            textPass "$regx: ALB $ALB_NAME is protected by AWS Shield Advanced" "$regx" "$ALB_NAME"
+          else
+            textFail "$regx: ALB $ALB_NAME is not protected by AWS Shield Advanced" "$regx" "$ALB_NAME"
+          fi
+        done <<<"$LIST_OF_APPLICATION_LOAD_BALANCERS"
+      else
+        textPass "$regx: no application load balancers found" "$regx"
+      fi
+    done
+  else
+    textInfo "No AWS Shield Advanced subscription found. Skipping check."
+  fi
+}

From 586d1f308c03a71b6c318bce2cf19f4da69349c6 Mon Sep 17 00:00:00 2001
From: Michael Dickinson
 <45626543+michael-dickinson-sainsburys@users.noreply.github.com>
Date: Thu, 23 Dec 2021 15:21:51 +0000
Subject: [PATCH 6/7] New check 7171 Classic load balancers are protected by
 AWS Shield Advanced

---
 checks/check_extra7171 | 50 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 50 insertions(+)
 create mode 100644 checks/check_extra7171

diff --git a/checks/check_extra7171 b/checks/check_extra7171
new file mode 100644
index 0000000000..87db38b355
--- /dev/null
+++ b/checks/check_extra7171
@@ -0,0 +1,50 @@
+#!/usr/bin/env bash
+
+# Prowler - the handy cloud security tool (copyright 2019) by Toni de la Fuente
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may not
+# use this file except in compliance with the License. You may obtain a copy
+# of the License at http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software distributed
+# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
+# CONDITIONS OF ANY KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations under the License.
+
+CHECK_ID_extra7171="7.171"
+CHECK_TITLE_extra7171="[extra7171] Check if classic load balancers are protected by AWS Shield"
+CHECK_SCORED_extra7171="NOT_SCORED"
+CHECK_CIS_LEVEL_extra7171="EXTRA"
+CHECK_SEVERITY_check="Medium"
+CHECK_ASFF_RESOURCE_TYPE_extra7171="AwsElasticLoadBalancingLoadBalancer"
+CHECK_ALTERNATE_extra7171="extra7171"
+CHECK_SERVICENAME_extra7171="shield"
+CHECK_RISK_extra7171='AWS Shield Advanced provides expanded DDoS attack protection for your resources'
+CHECK_REMEDIATION_extra7171='Add as a protected resource in AWS Shield Advanced.'
+CHECK_DOC_extra7171='https://docs.aws.amazon.com/waf/latest/developerguide/configure-new-protection.html'
+CHECK_CAF_EPIC_extra7171='Infrastructure security'
+
+extra7171() {
+  if [[ "$($AWSCLI shield get-subscription-state --output text)" == "ACTIVE" ]]; then
+    CALLER_IDENTITY=$($AWSCLI sts get-caller-identity $PROFILE_OPT --query Arn)
+    PARTITION=$(echo $CALLER_IDENTITY | cut -d: -f2)
+    ACCOUNT_ID=$(echo $CALLER_IDENTITY | cut -d: -f5)
+    for regx in $REGIONS; do
+      LIST_OF_CLASSIC_LOAD_BALANCERS=$($AWSCLI elb describe-load-balancers $PROFILE_OPT --region $regx --query 'LoadBalancerDescriptions[?Scheme == `internet-facing`].[LoadBalancerName]' --output text |grep -v '^None$')
+      if [[ $LIST_OF_CLASSIC_LOAD_BALANCERS ]]; then
+        for elb in $LIST_OF_CLASSIC_LOAD_BALANCERS; do
+          ELB_ARN="arn:${PARTITION}:elasticloadbalancing:${regx}:${ACCOUNT_ID}:loadbalancer/${elb}"
+          if aws shield describe-protection --resource-arn $ELB_ARN >/dev/null 2>&1; then
+            textPass "$regx: ELB $elb is protected by AWS Shield Advanced" "$regx" "$elb"
+          else
+            textFail "$regx: ELB $elb is not protected by AWS Shield Advanced" "$regx" "$elb"
+          fi
+        done
+      else
+        textPass "$regx: no classic load balancers found" "$regx"
+      fi
+    done
+  else
+    textInfo "No AWS Shield Advanced subscription found. Skipping check."
+  fi
+}

From d707f5d994e0361f89237f0e636ef38d79c64a5b Mon Sep 17 00:00:00 2001
From: Michael Dickinson
 <45626543+michael-dickinson-sainsburys@users.noreply.github.com>
Date: Thu, 23 Dec 2021 22:36:53 +0000
Subject: [PATCH 7/7] Include example for global resources

---
 checks/check_sample | 30 ++++++++++++++++++++++++++----
 1 file changed, 26 insertions(+), 4 deletions(-)

diff --git a/checks/check_sample b/checks/check_sample
index b7b284bf18..873aa2ba83 100644
--- a/checks/check_sample
+++ b/checks/check_sample
@@ -23,7 +23,6 @@
 #     --filter-pattern '{ ($.eventName = CreateTrail) || ($.eventName = UpdateTrail) || ($.eventName = DeleteTrail) || ($.eventName = StartLogging) || ($.eventName = StopLogging) }' \
 #     --metric-transformations metricName=CloudTrailEventCount,metricNamespace=CloudTrailMetrics,metricValue=1
 
-
 # CHECK_ID_checkN="N.N"
 # CHECK_TITLE_checkN="[checkN] Description "
 # CHECK_SCORED_checkN="NOT_SCORED"
@@ -31,8 +30,13 @@
 # CHECK_SEVERITY_check="Medium"
 # CHECK_ASFF_RESOURCE_TYPE_checkN="AwsAccount" # Choose appropriate value from https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-findings-format.html#asff-resources
 # CHECK_ALTERNATE_checkN="extraN"
-# CHECK_SERVICENAME_checkN="service" # get service short name from `curl -s https://api.regional-table.region-services.aws.a2z.com/index.json | jq -r '.prices[] | .id' | awk -F: '{ print $1 }' | sort -u` 
-#
+# CHECK_SERVICENAME_checkN="service" # get service short name from `curl -s https://api.regional-table.region-services.aws.a2z.com/index.json | jq -r '.prices[] | .id' | awk -F: '{ print $1 }' | sort -u`
+# CHECK_RISK_checkN=""
+# CHECK_REMEDIATION_checkN=""
+# CHECK_DOC_checkN=""
+# CHECK_CAF_EPIC_checkN=""
+
+# Example of regional resource
 # extraN(){
 #   # "Description "
 #   textInfo "Looking for instances in all regions...  "
@@ -42,10 +46,28 @@
 #       while read -r instance;do
 #         INSTANCE_ID=$(echo $instance | awk '{ print $1; }')
 #         PUBLIC_IP=$(echo $instance | awk '{ print $2; }')
-#         textFail "$regx: Instance: $INSTANCE_ID at IP: $PUBLIC_IP is internet-facing!" "$regx"
+#         textFail "$regx: Instance: $INSTANCE_ID at IP: $PUBLIC_IP is internet-facing!" "$regx" "$INSTANCE_ID"
 #       done <<< "$LIST_OF_PUBLIC_INSTANCES"
 #       else
 #         textPass "$regx: no Internet Facing EC2 Instances found" "$regx"
 #     fi
 #   done
 # }
+
+# Example of global resource
+# extraN(){
+#   # "Description "
+#   LIST_DISTRIBUTIONS=$($AWSCLI cloudfront list-distributions $PROFILE_OPT --query 'DistributionList.Items[*].Id' --output text |grep -v ^None)
+#   if [[ $LIST_DISTRIBUTIONS ]]; then
+#     for dist in $LIST_DISTRIBUTIONS; do
+#       GEO_ENABLED=$($AWSCLI cloudfront get-distribution-config $PROFILE_OPT --id $dist --query DistributionConfig.Restrictions.GeoRestriction.RestrictionType --output text)
+#       if [[ $GEO_ENABLED == "none" ]]; then
+#         textFail "$REGION: CloudFront distribution $dist has not Geo restrictions" "$REGION" "$dist"
+#       else
+#         textPass "$REGION: CloudFront distribution $dist has Geo restrictions enabled" "$REGION" "$dist"
+#       fi
+#     done
+#   else
+#     textInfo "$REGION: No CloudFront distributions found"
+#   fi
+# }