add ssl enforcement policy

terraform-modules · Sep 24, 2020 · 61bc94d · 61bc94d
1 parent 873e16c
commit 61bc94d
Showing 1 changed file with 12 additions and 0 deletions.
diff --git a/main.tf b/main.tf
@@ -97,6 +97,18 @@ data "aws_iam_policy_document" "this" {
       values   = ["true"]
     }
   }
+  statement  { 
+    sid         = "enforceSSL"
+    effe        = "Deny"
+    principals  =  "*",
+    actions     = "s3:*",
+    resources   = [aws_s3_bucket.this.arn, "${aws_s3_bucket.this.arn}/*"]
+    condition {
+         test     = "Bool"
+         variable = "aws:SecureTransport"
+         values   = ["false"]
+    }
+  }
 }
 
 #---