KEH-2224 - feat: add S3 bucket policy to enforce SSL connections (#47)

* feat: add S3 bucket policy to enforce SSL connections
* feat: add storage module initialization and apply in terraform_infra.sh
* deployment order

Author: mwirikia

concourse/scripts/terraform_infra.sh

@@ -18,7 +18,17 @@ if [[ ${env} != "prod" ]]; then
     env="dev"
 fi
 
-cd resource-repo/terraform/lambda
+cd resource-repo/terraform/storage
+
+terraform init -backend-config=env/${env}/backend-${env}.tfbackend -reconfigure
+terraform apply \
+-var "aws_account_id=$aws_account_id" \
+-var "aws_access_key_id=$aws_access_key_id" \
+-var "aws_secret_access_key=$aws_secret_access_key" \
+-var "domain=$domain" \
+-auto-approve
+
+cd ../lambda
 
 terraform init -backend-config=env/${env}/backend-${env}.tfbackend -reconfigure
 terraform apply \
@@ -40,4 +50,3 @@ terraform apply \
 -var "aws_secret_access_key=$aws_secret_access_key" \
 -var "domain=$domain" \
 -auto-approve
-

terraform/storage/storage.tf

@@ -31,4 +31,36 @@ resource "aws_s3_bucket_server_side_encryption_configuration" "encrypt_by_defaul
       sse_algorithm = "AES256"
     }
   }
+}
+
+data "aws_iam_policy_document" "deny_insecure_transport" {
+  statement {
+    sid    = "DenyInsecureTransport"
+    effect = "Deny"
+
+    principals {
+      type        = "*"
+      identifiers = ["*"]
+    }
+
+    actions = [
+      "s3:*"
+    ]
+
+    resources = [
+      aws_s3_bucket.tech_audit_data_bucket.arn,
+      "${aws_s3_bucket.tech_audit_data_bucket.arn}/*"
+    ]
+
+    condition {
+      test     = "Bool"
+      variable = "aws:SecureTransport"
+      values   = ["false"]
+    }
+  }
+}
+
+resource "aws_s3_bucket_policy" "enforce_ssl" {
+  bucket = aws_s3_bucket.tech_audit_data_bucket.id
+  policy = data.aws_iam_policy_document.deny_insecure_transport.json
 }