Merge pull request #59 from in4it/feature/only-ssl-s3

allow only ssl connections to s3 bucket
in4it · Apr 9, 2021 · 8d2649c · 8d2649c
2 parents d6b7e79 + 0013dd2
commit 8d2649c
Showing 1 changed file with 24 additions and 0 deletions.
diff --git a/terraform/s3.tf b/terraform/s3.tf
@@ -22,6 +22,30 @@ resource "aws_s3_bucket" "roxprox" {
       }
     }
   }
+
+  policy = <<EOF
+{
+  "Id": "S3Policy",
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Sid": "AllowSSLRequestsOnly",
+      "Action": "s3:*",
+      "Effect": "Deny",
+      "Resource": [
+        "arn:aws:s3:::${var.s3_bucket}",
+        "arn:aws:s3:::${var.s3_bucket}/*"
+      ],
+      "Condition": {
+        "Bool": {
+          "aws:SecureTransport": "false"
+        }
+      },
+      "Principal": "*"
+    }
+  ]
+}
+EOF
 }
 
 resource "aws_s3_bucket_public_access_block" "roxprox" {