pleme 0.0.32 → 0.0.40

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 984407e0f9e551544fbef6a4905045adc641bd9c
-  data.tar.gz: d2ea7f9dc5d16b61e528c26ecfd9ef4220c7444b
+  metadata.gz: 8db00856b533ae29bd65d909285f9414b53cf324
+  data.tar.gz: 8795bbe8839828c7153611ec8d0005c2926f8fbf
 SHA512:
-  metadata.gz: 5f4bd8799e8d10f0a0234e96060ea732ea1cee48254fa810dfecaf47344fc480674d84dec145694106a4f063db05fc69089733bb301a73fd41c667290c463349
-  data.tar.gz: 441a96465efe0a72d794a75fea0689c991ce87955ab90a4e5a660d2c4666394581b8d69779b598b4ca516681f6ef094868eab39f1ab93ee55aeb1fb1509476af
+  metadata.gz: df20e240c929be96b060a3d82a36374f65686ed103a404092c5b77ee5835a4432a7c0e361739ed9355f2e890060f8cb66c1f0d05b01db4c3e23afa2ac01a37d0
+  data.tar.gz: 7ba0ef82e054056548572a3828aec45d19654ff8499f73d3d5ac005a4e03aa8eebd28578bb8604896fe20fc30035f45ccac9da036112319791593aed1d8ad6ad

data/Gemfile.lock

@@ -1,19 +1,49 @@
 PATH
   remote: .
   specs:
-    pleme (0.0.30)
+    pleme (0.0.39)
+      aws-sdk-cloudfront
+      aws-sdk-ec2
+      aws-sdk-elasticloadbalancingv2
+      aws-sdk-elasticsearchservice
+      aws-sdk-rds
       docopt
 
 GEM
   remote: https://rubygems.org/
   specs:
     ast (2.4.1)
+    aws-eventstream (1.1.0)
+    aws-partitions (1.375.0)
+    aws-sdk-cloudfront (1.42.0)
+      aws-sdk-core (~> 3, >= 3.99.0)
+      aws-sigv4 (~> 1.1)
+    aws-sdk-core (3.107.0)
+      aws-eventstream (~> 1, >= 1.0.2)
+      aws-partitions (~> 1, >= 1.239.0)
+      aws-sigv4 (~> 1.1)
+      jmespath (~> 1.0)
+    aws-sdk-ec2 (1.195.0)
+      aws-sdk-core (~> 3, >= 3.99.0)
+      aws-sigv4 (~> 1.1)
+    aws-sdk-elasticloadbalancingv2 (1.51.0)
+      aws-sdk-core (~> 3, >= 3.99.0)
+      aws-sigv4 (~> 1.1)
+    aws-sdk-elasticsearchservice (1.42.0)
+      aws-sdk-core (~> 3, >= 3.99.0)
+      aws-sigv4 (~> 1.1)
+    aws-sdk-rds (1.99.0)
+      aws-sdk-core (~> 3, >= 3.99.0)
+      aws-sigv4 (~> 1.1)
+    aws-sigv4 (1.2.2)
+      aws-eventstream (~> 1, >= 1.0.2)
     backport (1.1.2)
     benchmark (0.1.0)
     diff-lcs (1.4.4)
     docopt (0.6.1)
     e2mmap (0.1.0)
     jaro_winkler (1.5.4)
+    jmespath (1.4.0)
     maruku (0.7.3)
     mini_portile2 (2.4.0)
     nokogiri (1.10.10)

data/docker-compose.yml

@@ -0,0 +1,10 @@
+---
+version: '3.7'
+services:
+  mongo:
+    image: mongo
+  graphql:
+    build:
+      dockerfile: "../lilitu/Dockerfile"
+      context: "."
+      target: graphql

data/go.sh

@@ -0,0 +1,5 @@
+#!/usr/bin/env sh
+
+set -e
+
+rake install && pleme truvantis scan

data/lib/pleme/cli.rb

@@ -19,9 +19,10 @@ class Cli
         pleme plan
         pleme apply
         pleme destroy
-        pleme compose up
+        pleme compose up [-d]
         pleme compose down
         pleme compose build
+        pleme truvantis scan
     DOCOPT
   end
 

data/lib/pleme/gem/version.rb

@@ -2,6 +2,6 @@
 
 module Pleme
   module Gem
-    VERSION = '0.0.32'
+    VERSION = '0.0.40'
   end
 end

data/lib/pleme/runner.rb

@@ -8,6 +8,7 @@
 require 'pleme/plemec_translator'
 require 'yaml'
 require 'json'
+require 'pleme/scanner'
 
 class Runner
   def initialize
@@ -27,7 +28,7 @@ class Runner
   # pipe hash to yaml without
   # weird symbol issues
   def yamilify(rhash)
-    YAML.safe_load(JSON.parse(rhash.to_json)).to_yaml
+    JSON.parse(rhash.to_json).to_yaml
   end
 
   def run(spec)
@@ -36,10 +37,11 @@ class Runner
     @spec = spec    if @spec.nil?
     dotfiles(spec)  if spec[:dotfiles]
 
-    if spec[:compose]
-      compose(:up) if spec[:up]
-      compose(:down) if spec[:down]
-      compose(:build) if spec[:build]
+    compose if spec[:compose]
+
+    if spec[:truvantis] && spec[:scan]
+      scan = Scanner.new.truvantis_public_scan
+      File.write('truvantis_scan.json', JSON.pretty_generate(scan))
     end
   end
 
@@ -52,16 +54,15 @@ class Runner
     hax_portal
   end
 
-  def compose(direction)
+  def compose
     config = read_config
     $logger.info config
     config[:pleme][:environment].keys.each do |env|
       config[:pleme][:environment][env].keys.each do |param|
         case param
         when :compose
-          $logger.info env
           File.write('docker-compose.yml', yamilify(config[:pleme][:environment][env][:compose]))
-          sh "docker-compose #{direction}"
+          sh "docker-compose #{ARGV[1..-1].join(' ')}"
         end
       end
     end

data/lib/pleme/scanner.rb

@@ -0,0 +1,205 @@
+# frozen_string_literal: true
+
+require 'aws-sdk-cloudfront'
+require 'aws-sdk-ec2'
+require 'aws-sdk-elasticloadbalancingv2'
+require 'aws-sdk-elasticsearchservice'
+require 'aws-sdk-rds'
+require 'json'
+
+# scan stuff
+class Scanner
+  # There is no logic in this scan that would pick up
+  # services we are currently not using that may have
+  # the potential to create new public endpoints.
+  # for example, we do not use dynamodb but it could have public endpoints if
+  # we did begin using it.
+  #
+  # services chosen to be scanned here are the intersection of what we use
+  # and what I suspect has public ips.
+  def truvantis_public_scan(aws_access_key_id: nil, aws_secret_access_key: nil)
+    aws_access_key_id     = ENV['AWS_ACCESS_KEY_ID'] if aws_access_key_id.nil?
+    aws_secret_access_key = ENV['AWS_SECRET_ACCESS_KEY'] if aws_secret_access_key.nil?
+
+    ###########################################################################
+    # cloudfront
+    ###########################################################################
+
+    report                              = {}
+    report[:cloudfront]                 = {}
+    report[:cloudfront][:distributions] = {}
+
+    region = ENV['AWS_REGION'] ||
+             ENV['AWS_DEFAULT_REGION'] ||
+             'us-east-1'
+
+    credentials = Aws::Credentials.new(aws_access_key_id, aws_secret_access_key)
+    cf_client   = Aws::CloudFront::Client.new(region: region, credentials: credentials)
+    cf_set      = cf_client.list_distributions.distribution_list.to_h
+
+    # get the domain name which may be public
+    # attach the arn for unique object identification as it may be useful to truvantis
+    # attach aliases to potentially be scanned as well
+    cf_set[:items].each do |item|
+      report[:cloudfront][:distributions] = { (item[:id]).to_s => {
+        domain: item[:domain_name],
+        arn: item[:arn],
+        aliases: item[:aliases]
+      } }
+    end
+
+    # I purposefully did not include origin endpoints
+    # as those will always be either an EIP, Instance, or LB
+    # all of which are included in more downstream scans
+
+    ###########################################################################
+    # ec2
+    ###########################################################################
+    # any public instances and interfaces
+
+    report[:ec2] = {}
+    report[:ec2][:instances] = {}
+
+    ec2_client = Aws::EC2::Client.new(region: region, credentials: credentials)
+
+    inst_set = ec2_client.describe_instances.to_h[:reservations]
+    inst_set.each do |reservation|
+      reservation[:instances].each do |instance|
+        # record instance public_ip
+        report[:ec2][:instances][(instance[:instance_id]).to_s] = { public_ip: instance[:public_ip] }
+
+        # record a few things about the instance that may be useful
+        report[:ec2][:instances][(instance[:instance_id]).to_s] = \
+          { public_dns_name: instance[:public_dns_name] }
+
+        # instances might have network_interfaces attached
+        next unless instance[:network_interfaces].any?
+
+        # check for important things in each interface
+        instance[:network_interfaces].each do |net_inter|
+          next if net_inter[:association].nil?
+
+          report[:ec2][:instances][(instance[:instance_id]).to_s] = \
+            { network_interface: {
+              carrier_ip: net_inter[:association][:carrier_ip],
+              public_ip: net_inter[:association][:public_ip]
+            } }
+        end
+      end
+    end
+
+    ###########################################################################
+    # load balancers
+    ###########################################################################
+    # any public instances and interfaces
+
+    report[:lb] = {}
+    report[:lb][:load_balancers] = {}
+
+    lb_client = Aws::ElasticLoadBalancingV2::Client.new(region: region, credentials: credentials)
+
+    # I am including internal facing load balancers and
+    # truvantis can filter out internals
+    lb_set = lb_client.describe_load_balancers.to_h
+    lb_set[:load_balancers].each do |lb|
+      report[:lb][:load_balancers][(lb[:load_balancer_name]).to_s] = {
+        dns_name: lb[:dns_name],
+        scheme: lb[:scheme],
+        type: lb[:type]
+      }
+      report[:lb][:load_balancers][(lb[:load_balancer_name]).to_s][:addresses] = []
+
+      # gather actual ip addresses as well
+      lb[:availability_zones].each do |zone|
+        zone[:load_balancer_addresses].each do |addy|
+          report[:lb][:load_balancers][(lb[:load_balancer_name]).to_s][:addresses] << addy[:ip_address]
+        end
+      end
+    end
+
+    ###########################################################################
+    # elastic ips
+    ###########################################################################
+    # uses ec2 client and weird method describe_addresses
+    report[:eips] = []
+
+    # grab public ips for eips
+    ec2_client.describe_addresses.to_h[:addresses].each do |addy|
+      report[:eips] << addy[:public_ip] if addy[:public_ip]
+    end
+
+    ###########################################################################
+    # network interfaces
+    ###########################################################################
+    # uses ec2 client and describe_network_interfaces
+
+    report[:network_interfaces] = {}
+    ec2_client.describe_network_interfaces.to_h[:network_interfaces].each do |net_inter|
+      next if net_inter[:association].nil?
+
+      report[:network_interfaces][(net_inter[:network_interface_id]).to_s] = {
+        association: {
+          public_ip: net_inter[:association][:public_ip],
+          public_dns_name: net_inter[:association][:public_dns_name]
+        }
+      }
+
+      # apparently private_ip_address associations can have public ips
+      # grab any of those endpoints if any exist
+      next unless net_inter[:private_ip_addresses].any?
+
+      net_inter[:private_ip_addresses].each do |pia|
+        next if report[:network_interfaces][(net_inter[:network_interface_id]).to_s][:private_ip_addresses].nil?
+        next unless report[:network_interfaces][(net_inter[:network_interface_id]).to_s][:private_ip_addresses].any?
+
+        report[:network_interfaces][(net_inter[:network_interface_id]).to_s]\
+          [:private_ip_addresses] << {
+            public_dns_name: pia[:association][:public_dns_name],
+            public_ip: pia[:association][:public_ip]
+          }
+      end
+    end
+
+    ###########################################################################
+    # elasticsearch as a service may have public endpoints
+    ###########################################################################
+    # Aws::ElasticsearchService and describe elasticsearch domains
+
+    es_client = Aws::ElasticsearchService::Client.new(region: region, credentials: credentials)
+
+    domain_names = []
+    es_client.list_domain_names.to_h[:domain_names].each do |dn|
+      domain_names << dn[:domain_name]
+    end
+
+    report[:es] = {}
+    es_client.describe_elasticsearch_domains(domain_names: domain_names).to_h[:domain_status_list].each do |domain|
+      report[:es][(domain[:domain_id]).to_s] = { endpoints: domain[:endpoints] }
+    end
+
+    ###########################################################################
+    # rds
+    ###########################################################################
+    # databases may have public endpoints
+    rds_client = Aws::RDS::Client.new(region: region, credentials: credentials)
+    rds_set = rds_client.describe_db_instances.to_h
+    unless rds_set[:db_instances].nil?
+      if rds_set[:db_instances].any?
+        report[:rds] = {}
+        rds_set[:db_instances].each do |dbi|
+          report[:rds][(dbi[:db_instance_arn]).to_s] = { endpoint: dbi[:endpoint] }
+        end
+      end
+    end
+
+    ###########################################################################
+    # bonus: open security groups and their associated resources
+    ###########################################################################
+
+    ###########################################################################
+    # bonus: open network acls
+    ###########################################################################
+
+    report
+  end
+end

data/pleme.gemspec

@@ -20,6 +20,11 @@ Gem::Specification.new do |spec|
   spec.test_files            = spec.files.grep(%r{^(test|spec|features)/})
   spec.require_paths         = ['lib']
   spec.required_ruby_version = '>= 2.4.0'
+  spec.add_dependency('aws-sdk-cloudfront')
+  spec.add_dependency('aws-sdk-ec2')
+  spec.add_dependency('aws-sdk-elasticloadbalancingv2')
+  spec.add_dependency('aws-sdk-elasticsearchservice')
+  spec.add_dependency('aws-sdk-rds')
   spec.add_dependency('docopt')
   spec.add_development_dependency('rake')
   spec.add_development_dependency('rspec')

data/plemec.rb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+####################################################
+# basic resource schema
+####################################################
+# pleme :resource_type, :resource_virtual_name do
+#   params
+# end
+####################################################
+
+pleme :environment, :dev do
+  app     :lilitu
+  infra   resource: :new
+  compose version: '3.7',
+          services: {
+            mongo: { image: 'mongo' },
+            graphql: {
+              build: {
+                dockerfile: '../lilitu/Dockerfile',
+                context: '.',
+                target: 'graphql'
+              }
+            }
+          }
+end

data/results.json

@@ -0,0 +1,913 @@
+{
+  "id": "E1IDK8V7MGA46A",
+  "arn": "arn:aws:cloudfront::373533792662:distribution/E1IDK8V7MGA46A",
+  "status": "Deployed",
+  "last_modified_time": "2019-08-10 02:32:52 UTC",
+  "domain_name": "d3o2mwpz5n87n0.cloudfront.net",
+  "aliases": {
+    "quantity": 2,
+    "items": [
+      "jedha.tapresearch.com",
+      "cdn.je.tapresearch.com"
+    ]
+  },
+  "origins": {
+    "quantity": 1,
+    "items": [
+      {
+        "id": "je-cloudfront-raynor",
+        "domain_name": "lb.je.tapresearch.io",
+        "origin_path": "",
+        "custom_headers": {
+          "quantity": 0
+        },
+        "custom_origin_config": {
+          "http_port": 80,
+          "https_port": 443,
+          "origin_protocol_policy": "https-only",
+          "origin_ssl_protocols": {
+            "quantity": 1,
+            "items": [
+              "TLSv1.2"
+            ]
+          },
+          "origin_read_timeout": 60,
+          "origin_keepalive_timeout": 60
+        },
+        "connection_attempts": 3,
+        "connection_timeout": 10
+      }
+    ]
+  },
+  "origin_groups": {
+    "quantity": 0
+  },
+  "default_cache_behavior": {
+    "target_origin_id": "je-cloudfront-raynor",
+    "trusted_signers": {
+      "enabled": false,
+      "quantity": 0
+    },
+    "viewer_protocol_policy": "redirect-to-https",
+    "allowed_methods": {
+      "quantity": 7,
+      "items": [
+        "HEAD",
+        "DELETE",
+        "POST",
+        "GET",
+        "OPTIONS",
+        "PUT",
+        "PATCH"
+      ],
+      "cached_methods": {
+        "quantity": 2,
+        "items": [
+          "HEAD",
+          "GET"
+        ]
+      }
+    },
+    "smooth_streaming": false,
+    "compress": true,
+    "lambda_function_associations": {
+      "quantity": 0
+    },
+    "field_level_encryption_id": "",
+    "forwarded_values": {
+      "query_string": true,
+      "cookies": {
+        "forward": "all"
+      },
+      "headers": {
+        "quantity": 1,
+        "items": [
+          "*"
+        ]
+      },
+      "query_string_cache_keys": {
+        "quantity": 0
+      }
+    },
+    "min_ttl": 0,
+    "default_ttl": 86400,
+    "max_ttl": 31536000
+  },
+  "cache_behaviors": {
+    "quantity": 2,
+    "items": [
+      {
+        "path_pattern": "/assets/*",
+        "target_origin_id": "je-cloudfront-raynor",
+        "trusted_signers": {
+          "enabled": false,
+          "quantity": 0
+        },
+        "viewer_protocol_policy": "redirect-to-https",
+        "allowed_methods": {
+          "quantity": 2,
+          "items": [
+            "HEAD",
+            "GET"
+          ],
+          "cached_methods": {
+            "quantity": 2,
+            "items": [
+              "HEAD",
+              "GET"
+            ]
+          }
+        },
+        "smooth_streaming": false,
+        "compress": true,
+        "lambda_function_associations": {
+          "quantity": 0
+        },
+        "field_level_encryption_id": "",
+        "forwarded_values": {
+          "query_string": false,
+          "cookies": {
+            "forward": "none"
+          },
+          "headers": {
+            "quantity": 1,
+            "items": [
+              "Host"
+            ]
+          },
+          "query_string_cache_keys": {
+            "quantity": 0
+          }
+        },
+        "min_ttl": 0,
+        "default_ttl": 86400,
+        "max_ttl": 31536000
+      },
+      {
+        "path_pattern": "/packs/*",
+        "target_origin_id": "je-cloudfront-raynor",
+        "trusted_signers": {
+          "enabled": false,
+          "quantity": 0
+        },
+        "viewer_protocol_policy": "redirect-to-https",
+        "allowed_methods": {
+          "quantity": 2,
+          "items": [
+            "HEAD",
+            "GET"
+          ],
+          "cached_methods": {
+            "quantity": 2,
+            "items": [
+              "HEAD",
+              "GET"
+            ]
+          }
+        },
+        "smooth_streaming": false,
+        "compress": true,
+        "lambda_function_associations": {
+          "quantity": 0
+        },
+        "field_level_encryption_id": "",
+        "forwarded_values": {
+          "query_string": false,
+          "cookies": {
+            "forward": "none"
+          },
+          "headers": {
+            "quantity": 1,
+            "items": [
+              "Host"
+            ]
+          },
+          "query_string_cache_keys": {
+            "quantity": 0
+          }
+        },
+        "min_ttl": 0,
+        "default_ttl": 86400,
+        "max_ttl": 31536000
+      }
+    ]
+  },
+  "custom_error_responses": {
+    "quantity": 0
+  },
+  "comment": "je-cloudfront-raynor",
+  "price_class": "PriceClass_100",
+  "enabled": true,
+  "viewer_certificate": {
+    "acm_certificate_arn": "arn:aws:acm:us-east-1:373533792662:certificate/2ab64b56-ce35-4116-99e5-91ac5141b063",
+    "ssl_support_method": "sni-only",
+    "minimum_protocol_version": "TLSv1",
+    "certificate": "arn:aws:acm:us-east-1:373533792662:certificate/2ab64b56-ce35-4116-99e5-91ac5141b063",
+    "certificate_source": "acm"
+  },
+  "restrictions": {
+    "geo_restriction": {
+      "restriction_type": "none",
+      "quantity": 0
+    }
+  },
+  "web_acl_id": "",
+  "http_version": "HTTP2",
+  "is_ipv6_enabled": true,
+  "alias_icp_recordals": [
+    {
+      "cname": "cdn.je.tapresearch.com",
+      "icp_recordal_status": "APPROVED"
+    },
+    {
+      "cname": "jedha.tapresearch.com",
+      "icp_recordal_status": "APPROVED"
+    }
+  ]
+}
+{
+  "id": "E3D0PNT6PGI431",
+  "arn": "arn:aws:cloudfront::373533792662:distribution/E3D0PNT6PGI431",
+  "status": "Deployed",
+  "last_modified_time": "2019-08-10 02:58:26 UTC",
+  "domain_name": "d2xrlyt627lqpx.cloudfront.net",
+  "aliases": {
+    "quantity": 2,
+    "items": [
+      "staging.tapresearch.com",
+      "cdn.st.tapresearch.com"
+    ]
+  },
+  "origins": {
+    "quantity": 1,
+    "items": [
+      {
+        "id": "st-cloudfront-raynor",
+        "domain_name": "lb.st.tapresearch.io",
+        "origin_path": "",
+        "custom_headers": {
+          "quantity": 0
+        },
+        "custom_origin_config": {
+          "http_port": 80,
+          "https_port": 443,
+          "origin_protocol_policy": "https-only",
+          "origin_ssl_protocols": {
+            "quantity": 1,
+            "items": [
+              "TLSv1.2"
+            ]
+          },
+          "origin_read_timeout": 60,
+          "origin_keepalive_timeout": 60
+        },
+        "connection_attempts": 3,
+        "connection_timeout": 10
+      }
+    ]
+  },
+  "origin_groups": {
+    "quantity": 0
+  },
+  "default_cache_behavior": {
+    "target_origin_id": "st-cloudfront-raynor",
+    "trusted_signers": {
+      "enabled": false,
+      "quantity": 0
+    },
+    "viewer_protocol_policy": "redirect-to-https",
+    "allowed_methods": {
+      "quantity": 7,
+      "items": [
+        "HEAD",
+        "DELETE",
+        "POST",
+        "GET",
+        "OPTIONS",
+        "PUT",
+        "PATCH"
+      ],
+      "cached_methods": {
+        "quantity": 2,
+        "items": [
+          "HEAD",
+          "GET"
+        ]
+      }
+    },
+    "smooth_streaming": false,
+    "compress": true,
+    "lambda_function_associations": {
+      "quantity": 0
+    },
+    "field_level_encryption_id": "",
+    "forwarded_values": {
+      "query_string": true,
+      "cookies": {
+        "forward": "all"
+      },
+      "headers": {
+        "quantity": 1,
+        "items": [
+          "*"
+        ]
+      },
+      "query_string_cache_keys": {
+        "quantity": 0
+      }
+    },
+    "min_ttl": 0,
+    "default_ttl": 86400,
+    "max_ttl": 31536000
+  },
+  "cache_behaviors": {
+    "quantity": 2,
+    "items": [
+      {
+        "path_pattern": "/assets/*",
+        "target_origin_id": "st-cloudfront-raynor",
+        "trusted_signers": {
+          "enabled": false,
+          "quantity": 0
+        },
+        "viewer_protocol_policy": "redirect-to-https",
+        "allowed_methods": {
+          "quantity": 2,
+          "items": [
+            "HEAD",
+            "GET"
+          ],
+          "cached_methods": {
+            "quantity": 2,
+            "items": [
+              "HEAD",
+              "GET"
+            ]
+          }
+        },
+        "smooth_streaming": false,
+        "compress": true,
+        "lambda_function_associations": {
+          "quantity": 0
+        },
+        "field_level_encryption_id": "",
+        "forwarded_values": {
+          "query_string": false,
+          "cookies": {
+            "forward": "none"
+          },
+          "headers": {
+            "quantity": 1,
+            "items": [
+              "Host"
+            ]
+          },
+          "query_string_cache_keys": {
+            "quantity": 0
+          }
+        },
+        "min_ttl": 0,
+        "default_ttl": 86400,
+        "max_ttl": 31536000
+      },
+      {
+        "path_pattern": "/packs/*",
+        "target_origin_id": "st-cloudfront-raynor",
+        "trusted_signers": {
+          "enabled": false,
+          "quantity": 0
+        },
+        "viewer_protocol_policy": "redirect-to-https",
+        "allowed_methods": {
+          "quantity": 2,
+          "items": [
+            "HEAD",
+            "GET"
+          ],
+          "cached_methods": {
+            "quantity": 2,
+            "items": [
+              "HEAD",
+              "GET"
+            ]
+          }
+        },
+        "smooth_streaming": false,
+        "compress": true,
+        "lambda_function_associations": {
+          "quantity": 0
+        },
+        "field_level_encryption_id": "",
+        "forwarded_values": {
+          "query_string": false,
+          "cookies": {
+            "forward": "none"
+          },
+          "headers": {
+            "quantity": 1,
+            "items": [
+              "Host"
+            ]
+          },
+          "query_string_cache_keys": {
+            "quantity": 0
+          }
+        },
+        "min_ttl": 0,
+        "default_ttl": 86400,
+        "max_ttl": 31536000
+      }
+    ]
+  },
+  "custom_error_responses": {
+    "quantity": 0
+  },
+  "comment": "st-cloudfront-raynor",
+  "price_class": "PriceClass_100",
+  "enabled": true,
+  "viewer_certificate": {
+    "acm_certificate_arn": "arn:aws:acm:us-east-1:373533792662:certificate/2ab64b56-ce35-4116-99e5-91ac5141b063",
+    "ssl_support_method": "sni-only",
+    "minimum_protocol_version": "TLSv1",
+    "certificate": "arn:aws:acm:us-east-1:373533792662:certificate/2ab64b56-ce35-4116-99e5-91ac5141b063",
+    "certificate_source": "acm"
+  },
+  "restrictions": {
+    "geo_restriction": {
+      "restriction_type": "none",
+      "quantity": 0
+    }
+  },
+  "web_acl_id": "",
+  "http_version": "HTTP2",
+  "is_ipv6_enabled": true,
+  "alias_icp_recordals": [
+    {
+      "cname": "staging.tapresearch.com",
+      "icp_recordal_status": "APPROVED"
+    },
+    {
+      "cname": "cdn.st.tapresearch.com",
+      "icp_recordal_status": "APPROVED"
+    }
+  ]
+}
+{
+  "id": "E1YOITBMNMXCK7",
+  "arn": "arn:aws:cloudfront::373533792662:distribution/E1YOITBMNMXCK7",
+  "status": "Deployed",
+  "last_modified_time": "2019-08-10 04:39:39 UTC",
+  "domain_name": "d2xztbefcw8pto.cloudfront.net",
+  "aliases": {
+    "quantity": 3,
+    "items": [
+      "www.tapresearch.com",
+      "cdn.tapresearch.com",
+      "tapresearch.com"
+    ]
+  },
+  "origins": {
+    "quantity": 1,
+    "items": [
+      {
+        "id": "pr-cloudfront-raynor",
+        "domain_name": "lb.pr.tapresearch.io",
+        "origin_path": "",
+        "custom_headers": {
+          "quantity": 0
+        },
+        "custom_origin_config": {
+          "http_port": 80,
+          "https_port": 443,
+          "origin_protocol_policy": "https-only",
+          "origin_ssl_protocols": {
+            "quantity": 1,
+            "items": [
+              "TLSv1.2"
+            ]
+          },
+          "origin_read_timeout": 60,
+          "origin_keepalive_timeout": 60
+        },
+        "connection_attempts": 3,
+        "connection_timeout": 10
+      }
+    ]
+  },
+  "origin_groups": {
+    "quantity": 0
+  },
+  "default_cache_behavior": {
+    "target_origin_id": "pr-cloudfront-raynor",
+    "trusted_signers": {
+      "enabled": false,
+      "quantity": 0
+    },
+    "viewer_protocol_policy": "redirect-to-https",
+    "allowed_methods": {
+      "quantity": 7,
+      "items": [
+        "HEAD",
+        "DELETE",
+        "POST",
+        "GET",
+        "OPTIONS",
+        "PUT",
+        "PATCH"
+      ],
+      "cached_methods": {
+        "quantity": 2,
+        "items": [
+          "HEAD",
+          "GET"
+        ]
+      }
+    },
+    "smooth_streaming": false,
+    "compress": true,
+    "lambda_function_associations": {
+      "quantity": 0
+    },
+    "field_level_encryption_id": "",
+    "forwarded_values": {
+      "query_string": true,
+      "cookies": {
+        "forward": "all"
+      },
+      "headers": {
+        "quantity": 1,
+        "items": [
+          "*"
+        ]
+      },
+      "query_string_cache_keys": {
+        "quantity": 0
+      }
+    },
+    "min_ttl": 0,
+    "default_ttl": 86400,
+    "max_ttl": 31536000
+  },
+  "cache_behaviors": {
+    "quantity": 2,
+    "items": [
+      {
+        "path_pattern": "/assets/*",
+        "target_origin_id": "pr-cloudfront-raynor",
+        "trusted_signers": {
+          "enabled": false,
+          "quantity": 0
+        },
+        "viewer_protocol_policy": "redirect-to-https",
+        "allowed_methods": {
+          "quantity": 2,
+          "items": [
+            "HEAD",
+            "GET"
+          ],
+          "cached_methods": {
+            "quantity": 2,
+            "items": [
+              "HEAD",
+              "GET"
+            ]
+          }
+        },
+        "smooth_streaming": false,
+        "compress": true,
+        "lambda_function_associations": {
+          "quantity": 0
+        },
+        "field_level_encryption_id": "",
+        "forwarded_values": {
+          "query_string": false,
+          "cookies": {
+            "forward": "none"
+          },
+          "headers": {
+            "quantity": 1,
+            "items": [
+              "Host"
+            ]
+          },
+          "query_string_cache_keys": {
+            "quantity": 0
+          }
+        },
+        "min_ttl": 0,
+        "default_ttl": 86400,
+        "max_ttl": 31536000
+      },
+      {
+        "path_pattern": "/packs/*",
+        "target_origin_id": "pr-cloudfront-raynor",
+        "trusted_signers": {
+          "enabled": false,
+          "quantity": 0
+        },
+        "viewer_protocol_policy": "redirect-to-https",
+        "allowed_methods": {
+          "quantity": 2,
+          "items": [
+            "HEAD",
+            "GET"
+          ],
+          "cached_methods": {
+            "quantity": 2,
+            "items": [
+              "HEAD",
+              "GET"
+            ]
+          }
+        },
+        "smooth_streaming": false,
+        "compress": true,
+        "lambda_function_associations": {
+          "quantity": 0
+        },
+        "field_level_encryption_id": "",
+        "forwarded_values": {
+          "query_string": false,
+          "cookies": {
+            "forward": "none"
+          },
+          "headers": {
+            "quantity": 1,
+            "items": [
+              "Host"
+            ]
+          },
+          "query_string_cache_keys": {
+            "quantity": 0
+          }
+        },
+        "min_ttl": 0,
+        "default_ttl": 86400,
+        "max_ttl": 31536000
+      }
+    ]
+  },
+  "custom_error_responses": {
+    "quantity": 0
+  },
+  "comment": "pr-cloudfront-raynor",
+  "price_class": "PriceClass_100",
+  "enabled": true,
+  "viewer_certificate": {
+    "acm_certificate_arn": "arn:aws:acm:us-east-1:373533792662:certificate/2ab64b56-ce35-4116-99e5-91ac5141b063",
+    "ssl_support_method": "sni-only",
+    "minimum_protocol_version": "TLSv1",
+    "certificate": "arn:aws:acm:us-east-1:373533792662:certificate/2ab64b56-ce35-4116-99e5-91ac5141b063",
+    "certificate_source": "acm"
+  },
+  "restrictions": {
+    "geo_restriction": {
+      "restriction_type": "none",
+      "quantity": 0
+    }
+  },
+  "web_acl_id": "",
+  "http_version": "HTTP2",
+  "is_ipv6_enabled": true,
+  "alias_icp_recordals": [
+    {
+      "cname": "tapresearch.com",
+      "icp_recordal_status": "APPROVED"
+    },
+    {
+      "cname": "cdn.tapresearch.com",
+      "icp_recordal_status": "APPROVED"
+    },
+    {
+      "cname": "www.tapresearch.com",
+      "icp_recordal_status": "APPROVED"
+    }
+  ]
+}
+{
+  "id": "E1UOT14S5HMB0D",
+  "arn": "arn:aws:cloudfront::373533792662:distribution/E1UOT14S5HMB0D",
+  "status": "Deployed",
+  "last_modified_time": "2019-08-10 01:26:15 UTC",
+  "domain_name": "d1xrdicqtjcu82.cloudfront.net",
+  "aliases": {
+    "quantity": 2,
+    "items": [
+      "yavin.tapresearch.com",
+      "cdn.ya.tapresearch.com"
+    ]
+  },
+  "origins": {
+    "quantity": 1,
+    "items": [
+      {
+        "id": "ya-cloudfront-raynor",
+        "domain_name": "lb.ya.tapresearch.io",
+        "origin_path": "",
+        "custom_headers": {
+          "quantity": 0
+        },
+        "custom_origin_config": {
+          "http_port": 80,
+          "https_port": 443,
+          "origin_protocol_policy": "https-only",
+          "origin_ssl_protocols": {
+            "quantity": 1,
+            "items": [
+              "TLSv1.2"
+            ]
+          },
+          "origin_read_timeout": 60,
+          "origin_keepalive_timeout": 60
+        },
+        "connection_attempts": 3,
+        "connection_timeout": 10
+      }
+    ]
+  },
+  "origin_groups": {
+    "quantity": 0
+  },
+  "default_cache_behavior": {
+    "target_origin_id": "ya-cloudfront-raynor",
+    "trusted_signers": {
+      "enabled": false,
+      "quantity": 0
+    },
+    "viewer_protocol_policy": "redirect-to-https",
+    "allowed_methods": {
+      "quantity": 7,
+      "items": [
+        "HEAD",
+        "DELETE",
+        "POST",
+        "GET",
+        "OPTIONS",
+        "PUT",
+        "PATCH"
+      ],
+      "cached_methods": {
+        "quantity": 2,
+        "items": [
+          "HEAD",
+          "GET"
+        ]
+      }
+    },
+    "smooth_streaming": false,
+    "compress": true,
+    "lambda_function_associations": {
+      "quantity": 0
+    },
+    "field_level_encryption_id": "",
+    "forwarded_values": {
+      "query_string": true,
+      "cookies": {
+        "forward": "all"
+      },
+      "headers": {
+        "quantity": 1,
+        "items": [
+          "*"
+        ]
+      },
+      "query_string_cache_keys": {
+        "quantity": 0
+      }
+    },
+    "min_ttl": 0,
+    "default_ttl": 86400,
+    "max_ttl": 31536000
+  },
+  "cache_behaviors": {
+    "quantity": 2,
+    "items": [
+      {
+        "path_pattern": "/assets/*",
+        "target_origin_id": "ya-cloudfront-raynor",
+        "trusted_signers": {
+          "enabled": false,
+          "quantity": 0
+        },
+        "viewer_protocol_policy": "redirect-to-https",
+        "allowed_methods": {
+          "quantity": 2,
+          "items": [
+            "HEAD",
+            "GET"
+          ],
+          "cached_methods": {
+            "quantity": 2,
+            "items": [
+              "HEAD",
+              "GET"
+            ]
+          }
+        },
+        "smooth_streaming": false,
+        "compress": true,
+        "lambda_function_associations": {
+          "quantity": 0
+        },
+        "field_level_encryption_id": "",
+        "forwarded_values": {
+          "query_string": false,
+          "cookies": {
+            "forward": "none"
+          },
+          "headers": {
+            "quantity": 1,
+            "items": [
+              "Host"
+            ]
+          },
+          "query_string_cache_keys": {
+            "quantity": 0
+          }
+        },
+        "min_ttl": 0,
+        "default_ttl": 86400,
+        "max_ttl": 31536000
+      },
+      {
+        "path_pattern": "/packs/*",
+        "target_origin_id": "ya-cloudfront-raynor",
+        "trusted_signers": {
+          "enabled": false,
+          "quantity": 0
+        },
+        "viewer_protocol_policy": "redirect-to-https",
+        "allowed_methods": {
+          "quantity": 2,
+          "items": [
+            "HEAD",
+            "GET"
+          ],
+          "cached_methods": {
+            "quantity": 2,
+            "items": [
+              "HEAD",
+              "GET"
+            ]
+          }
+        },
+        "smooth_streaming": false,
+        "compress": true,
+        "lambda_function_associations": {
+          "quantity": 0
+        },
+        "field_level_encryption_id": "",
+        "forwarded_values": {
+          "query_string": false,
+          "cookies": {
+            "forward": "none"
+          },
+          "headers": {
+            "quantity": 1,
+            "items": [
+              "Host"
+            ]
+          },
+          "query_string_cache_keys": {
+            "quantity": 0
+          }
+        },
+        "min_ttl": 0,
+        "default_ttl": 86400,
+        "max_ttl": 31536000
+      }
+    ]
+  },
+  "custom_error_responses": {
+    "quantity": 0
+  },
+  "comment": "ya-cloudfront-raynor",
+  "price_class": "PriceClass_100",
+  "enabled": true,
+  "viewer_certificate": {
+    "acm_certificate_arn": "arn:aws:acm:us-east-1:373533792662:certificate/2ab64b56-ce35-4116-99e5-91ac5141b063",
+    "ssl_support_method": "sni-only",
+    "minimum_protocol_version": "TLSv1",
+    "certificate": "arn:aws:acm:us-east-1:373533792662:certificate/2ab64b56-ce35-4116-99e5-91ac5141b063",
+    "certificate_source": "acm"
+  },
+  "restrictions": {
+    "geo_restriction": {
+      "restriction_type": "none",
+      "quantity": 0
+    }
+  },
+  "web_acl_id": "",
+  "http_version": "HTTP2",
+  "is_ipv6_enabled": true,
+  "alias_icp_recordals": [
+    {
+      "cname": "yavin.tapresearch.com",
+      "icp_recordal_status": "APPROVED"
+    },
+    {
+      "cname": "cdn.ya.tapresearch.com",
+      "icp_recordal_status": "APPROVED"
+    }
+  ]
+}