add encryption enforcement

terraform-modules · Jun 22, 2020 · cdb73b6 · cdb73b6
1 parent d7f3ab6
commit cdb73b6
Showing 1 changed file with 32 additions and 0 deletions.
diff --git a/main.tf b/main.tf
@@ -22,6 +22,38 @@ resource "aws_s3_bucket" "this" {
     prevent_destroy = true
   }
 
+data "aws_iam_policy_document" "t26_s3" {
+  statement {
+    sid     = "DenyIncorrectEncryptionHeader"
+    effect  = "Deny"
+    actions = ["s3:PutObject"]
+    principals {
+      type        = "AWS"
+      identifiers = ["*"]
+    }
+    resources = ["${aws_s3_bucket.t26.arn}/*"]
+    condition {
+      test     = "StringNotEquals"
+      variable = "s3:x-amz-server-side-encryption"
+      values   = ["aws:kms"]
+    }
+  }
+  statement {
+    sid     = "DenyUnEncryptedObjectUploads"
+    effect  = "Deny"
+    actions = ["s3:PutObject"]
+    principals {
+      type        = "AWS"
+      identifiers = ["*"]
+    }
+    resources = ["${aws_s3_bucket.t26.arn}/*"]
+    condition {
+      test     = "Null"
+      variable = "s3:x-amz-server-side-encryption"
+      values     = ["true"]
+    }
+  }
+
   tags = merge(
     var.tags,
     local.enforced_tags,