allow only ssl connections to s3 bucket

in4it · Apr 9, 2021 · 0013dd2 · 0013dd2
1 parent d6b7e79
commit 0013dd2
Showing 1 changed file with 24 additions and 0 deletions.
diff --git a/terraform/s3.tf b/terraform/s3.tf
@@ -22,6 +22,30 @@ resource "aws_s3_bucket" "roxprox" {
       }
     }
   }
+
+  policy = <<EOF
+{
+  "Id": "S3Policy",
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Sid": "AllowSSLRequestsOnly",
+      "Action": "s3:*",
+      "Effect": "Deny",
+      "Resource": [
+        "arn:aws:s3:::${var.s3_bucket}",
+        "arn:aws:s3:::${var.s3_bucket}/*"
+      ],
+      "Condition": {
+        "Bool": {
+          "aws:SecureTransport": "false"
+        }
+      },
+      "Principal": "*"
+    }
+  ]
+}
+EOF
 }
 
 resource "aws_s3_bucket_public_access_block" "roxprox" {