ELM-1414 enforce TLS>=1.2 on landing bucket (#4693)

* enforce TLS>=1.2 on landing bucket

* change to use aws_iam_policy_document not raw json

* fix variable reference typo

* add principal statement

* remove whitespace

* fix type in resource ref

terraform/environments/electronic-monitoring-data/s3.tf

@@ -31,6 +31,32 @@ resource "aws_s3_bucket" "capita_landing_bucket" {
   bucket = "capita-${random_string.capita_random_string.result}"
 }
 
+resource "aws_s3_bucket_policy" "capita_landing_bucket_policy" {
+  bucket = aws_s3_bucket.capita_landing_bucket.id
+  policy = data.aws_iam_policy_document.capita_landing_bucket_policy_document.json
+}
+
+data "aws_iam_policy_document" "capita_landing_bucket_policy_document" {
+  statement {
+    sid = "EnforceTLSv12orHigher"
+    principals {
+      type = "AWS"
+      identifiers = ["*"]
+    }
+    effect = "Deny"
+    actions = ["s3:*"]
+    resources = [
+      aws_s3_bucket.capita_landing_bucket.arn,
+      "${aws_s3_bucket.capita_landing_bucket.arn}/*"
+    ]
+    condition {
+      test = "NumericLessThan"
+      variable = "s3:TlsVersion"
+      values = [1.2]
+    }
+  }
+}
+
 resource "aws_s3_bucket_versioning" "capita_landing_bucket" {
   bucket = aws_s3_bucket.capita_landing_bucket.id
   versioning_configuration {