Enforce SecureTransport policy on AccessLogsBucket (#863)

aws-cloudformation/cloudformation-cli#389 aws-cloudformation/cloudformation-cli#396
awesomedevchris · Oct 18, 2022 · 990d58c · 990d58c
1 parent a7f7653
commit 990d58c
Showing 1 changed file with 18 additions and 0 deletions.
diff --git a/src/rpdk/core/data/managed-upload-infrastructure.yaml b/src/rpdk/core/data/managed-upload-infrastructure.yaml
@@ -63,6 +63,24 @@ Resources:
                 "aws:SecureTransport": "false"
             Principal: "*"
 
+  AccessLogsBucketPolicy:
+    Type: AWS::S3::BucketPolicy
+    Properties:
+      Bucket: !Ref AccessLogsBucket
+      PolicyDocument:
+        Version: "2012-10-17"
+        Statement:
+          - Sid: Require Secure Transport
+            Action: "s3:*"
+            Effect: Deny
+            Resource:
+              - !Sub "arn:${AWS::Partition}:s3:::${AccessLogsBucket}"
+              - !Sub "arn:${AWS::Partition}:s3:::${AccessLogsBucket}/*"
+            Condition:
+              Bool:
+                "aws:SecureTransport": "false"
+            Principal: "*"
+
   EncryptionKey:
     Type: AWS::KMS::Key
     DeletionPolicy: Retain