From 0013dd20daf135fa9fbf6c9a7ad5aa74b4d8ee17 Mon Sep 17 00:00:00 2001
From: Andre Narciso <in4it-4@cake.app>
Date: Fri, 9 Apr 2021 14:45:25 +0000
Subject: [PATCH] allow only ssl connections to s3 bucket

---
 terraform/s3.tf | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/terraform/s3.tf b/terraform/s3.tf
index 9338013..d9696b2 100644
--- a/terraform/s3.tf
+++ b/terraform/s3.tf
@@ -22,6 +22,30 @@ resource "aws_s3_bucket" "roxprox" {
       }
     }
   }
+
+  policy = <<EOF
+{
+  "Id": "S3Policy",
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Sid": "AllowSSLRequestsOnly",
+      "Action": "s3:*",
+      "Effect": "Deny",
+      "Resource": [
+        "arn:aws:s3:::${var.s3_bucket}",
+        "arn:aws:s3:::${var.s3_bucket}/*"
+      ],
+      "Condition": {
+        "Bool": {
+          "aws:SecureTransport": "false"
+        }
+      },
+      "Principal": "*"
+    }
+  ]
+}
+EOF
 }
 
 resource "aws_s3_bucket_public_access_block" "roxprox" {