🛡️ Enforce secure transport on mojap buckets (#6509)

Signed-off-by: Jacob Woffenden <[email protected]>
ministryofjustice · Jan 6, 2025 · 1a240c3 · 1a240c3
1 parent 43d41c5
commit 1a240c3
Show file tree

Hide file tree

Showing 2 changed files with 36 additions and 1 deletion.
diff --git a/terraform/aws/analytical-platform-data-production/create-a-derived-table/buckets.tf b/terraform/aws/analytical-platform-data-production/create-a-derived-table/buckets.tf
@@ -121,6 +121,27 @@ module "mojap_cadet_production" {
 }
 
 data "aws_iam_policy_document" "mojap_cadet_production" {
+  statement {
+    sid     = "DenyInsecureTransport"
+    effect  = "Deny"
+    actions = ["s3:*"]
+
+    resources = [
+      "arn:aws:s3:::mojap-derived-tables/*",
+      "arn:aws:s3:::mojap-derived-tables"
+    ]
+
+    principals {
+      type        = "*"
+      identifiers = ["*"]
+    }
+
+    condition {
+      test     = "Bool"
+      variable = "aws:SecureTransport"
+      values   = ["false"]
+    }
+  }
   statement {
     sid    = "AllowCompliantPaths"
     effect = "Allow"

diff --git a/terraform/aws/analytical-platform-data-production/data-engineering-pipelines/locals.tf b/terraform/aws/analytical-platform-data-production/data-engineering-pipelines/locals.tf
@@ -2422,12 +2422,26 @@ locals {
               Resource = "arn:aws:s3:::mojap-raw-hist-dev/hmpps/oasys/*"
               Sid      = "DenyUnEncryptedObjectUploads-mojap-raw-hist-dev-hmpps-oasys"
             },
+            {
+              Action = "s3:*"
+              Condition = {
+                Bool = {
+                  "aws:SecureTransport" = "false"
+                }
+              }
+              Principal = "*"
+              Effect    = "Deny"
+              Resource = [
+                "arn:aws:s3:::mojap-raw-hist-dev/*",
+                "arn:aws:s3:::mojap-raw-hist-dev"
+              ]
+              Sid = "DenyInsecureTransport"
+            },
           ]
           Version = "2012-10-17"
         }
       )
     }
-
     "mojap-raw-hist-preprod" = {
       grant = [{
         id         = data.aws_canonical_user_id.current.id