feat: Added AccessedViaMountTarget condition for deny_nonsecure_trans…

…port (#21)

.pre-commit-config.yaml

@@ -1,6 +1,6 @@
 repos:
  - repo: https://github.com/antonbabenko/pre-commit-terraform
- rev: v1.83.5
+ rev: v1.86.0
  hooks:
  - id: terraform_fmt
  - id: terraform_validate

main.tf

@@ -100,6 +100,32 @@ data "aws_iam_policy_document" "policy" {
  }
  }
  }
+
+ dynamic "statement" {
+ for_each = var.deny_nonsecure_transport ? [1] : []
+
+ content {
+ sid = "NonSecureTransportAccessedViaMountTarget"
+ effect = "Allow"
+ actions = [
+ "elasticfilesystem:ClientRootAccess",
+ "elasticfilesystem:ClientWrite",
+ "elasticfilesystem:ClientMount"
+ ]
+ resources = [aws_efs_file_system.this[0].arn]
+
+ principals {
+ type = "AWS"
+ identifiers = ["*"]
+ }
+
+ condition {
+ test = "Bool"
+ variable = "elasticfilesystem:AccessedViaMountTarget"
+ values = ["true"]
+ }
+ }
+ }
 }
 
 resource "aws_efs_file_system_policy" "this" {