feat: s3 requires SSL by default

README.md

@@ -178,6 +178,7 @@ Optional policies have the option of being created by default, but are specified
 | vpc\_id | VPC ID to create resources in | `string` | n/a | yes |
 | wait_for_capacity_timeout | How long Terraform should wait for ASG instances to be healthy before timing out. | `string` | `"10m"` | no |
 | metadata_options | Instance Metadata Options | `map` | <pre>{<br>  http_endpoint: "enabled",<br>  http_tokens: "required",<br>  http_put_response_hop_limit: 1,<br>  instance_metadata_tags: "disabled"}</pre> | no |
+| statestore_attach_deny_insecure_transport_policy | Toggle for enabling s3 policy to reject non-SSL requests | `bool` | `true` | yes |
 
 ## Outputs
 

main.tf

@@ -41,6 +41,8 @@ module "statestore" {
   name   = local.uname
   token  = random_password.token.result
   tags   = merge(local.default_tags, var.tags)
+
+  attach_deny_insecure_transport_policy = var.statestore_attach_deny_insecure_transport_policy
 }
 
 #

modules/statestore/main.tf

@@ -47,3 +47,41 @@ data "aws_iam_policy_document" "setter" {
     ]
   }
 }
+
+data "aws_iam_policy_document" "deny_insecure_transport" {
+  count = var.attach_deny_insecure_transport_policy ? 1 : 0
+
+  statement {
+    sid    = "denyInsecureTransport"
+    effect = "Deny"
+
+    actions = [
+      "s3:*",
+    ]
+
+    resources = [
+      aws_s3_bucket.bucket.arn,
+      "${aws_s3_bucket.bucket.arn}/*",
+    ]
+
+    principals {
+      type        = "*"
+      identifiers = ["*"]
+    }
+
+    condition {
+      test     = "Bool"
+      variable = "aws:SecureTransport"
+      values = [
+        "false"
+      ]
+    }
+  }
+}
+
+resource "aws_s3_bucket_policy" "this" {
+  count = var.attach_deny_insecure_transport_policy ? 1 : 0
+
+  bucket = aws_s3_bucket.bucket.id
+  policy = data.aws_iam_policy_document.deny_insecure_transport[0].json
+}

modules/statestore/variables.tf

@@ -10,3 +10,7 @@ variable "tags" {
   type    = map(string)
   default = {}
 }
+
+variable "attach_deny_insecure_transport_policy" {
+  type = bool
+}

variables.tf

@@ -185,3 +185,12 @@ variable "extra_cloud_config_config" {
   default     = ""
 }
 
+#
+### Statestore Variables
+#
+
+variable "statestore_attach_deny_insecure_transport_policy" {
+  description = "Toggle for enabling s3 policy to reject non-SSL requests"
+  type        = bool
+  default     = true
+}