VED-1134: S3 Bucket Policy Missing SecureTransport Statement (#1326)

* Add HTTPS-only policies for S3 buckets in API Gateway and Splunk modules

- Introduced HTTPS-only IAM policy documents for S3 buckets used in API Gateway and Splunk to enhance security.
- Updated the S3 bucket policies to enforce HTTPS connections, preventing non-secure access to the stored certificates and logs.

* Refactor S3 bucket policy documents to standardize HTTPS-only enforcement

- Removed unnecessary S3 bucket policy data source.
- Updated policy statement IDs to "HTTPSOnly" for consistency across IAM policy documents related to S3 buckets in API Gateway.

Author: Thomas-Boyle

infrastructure/instance/modules/api_gateway/mtls_cert.tf

@@ -28,6 +28,66 @@ resource "aws_s3_bucket_versioning" "truststore_bucket" {
   }
 }
 
+data "aws_iam_policy_document" "cert_storage_https_only_s3_policy" {
+  statement {
+    sid    = "HTTPSOnly"
+    effect = "Deny"
+
+    principals {
+      type        = "AWS"
+      identifiers = ["*"]
+    }
+
+    actions = ["s3:*"]
+
+    resources = [
+      data.aws_s3_bucket.cert_storage.arn,
+      "${data.aws_s3_bucket.cert_storage.arn}/*",
+    ]
+
+    condition {
+      test     = "Bool"
+      variable = "aws:SecureTransport"
+      values   = ["false"]
+    }
+  }
+}
+
+data "aws_iam_policy_document" "truststore_https_only_s3_policy" {
+  statement {
+    sid    = "HTTPSOnly"
+    effect = "Deny"
+
+    principals {
+      type        = "AWS"
+      identifiers = ["*"]
+    }
+
+    actions = ["s3:*"]
+
+    resources = [
+      aws_s3_bucket.truststore_bucket.arn,
+      "${aws_s3_bucket.truststore_bucket.arn}/*",
+    ]
+
+    condition {
+      test     = "Bool"
+      variable = "aws:SecureTransport"
+      values   = ["false"]
+    }
+  }
+}
+
+resource "aws_s3_bucket_policy" "cert_storage_https_only" {
+  bucket = data.aws_s3_bucket.cert_storage.id
+  policy = data.aws_iam_policy_document.cert_storage_https_only_s3_policy.json
+}
+
+resource "aws_s3_bucket_policy" "truststore_https_only" {
+  bucket = aws_s3_bucket.truststore_bucket.id
+  policy = data.aws_iam_policy_document.truststore_https_only_s3_policy.json
+}
+
 resource "aws_s3_object_copy" "copy_cert_from_storage" {
   bucket = aws_s3_bucket.truststore_bucket.bucket
   key    = local.truststore_file_name

infrastructure/instance/modules/splunk/backup.tf

@@ -3,3 +3,33 @@ resource "aws_s3_bucket" "failed_logs_backup" {
   // To facilitate deletion of non empty busckets
   force_destroy = var.force_destroy
 }
+
+data "aws_iam_policy_document" "failed_logs_backup_https_only" {
+  statement {
+    sid    = "HTTPSOnly"
+    effect = "Deny"
+
+    principals {
+      type        = "AWS"
+      identifiers = ["*"]
+    }
+
+    actions = ["s3:*"]
+
+    resources = [
+      aws_s3_bucket.failed_logs_backup.arn,
+      "${aws_s3_bucket.failed_logs_backup.arn}/*",
+    ]
+
+    condition {
+      test     = "Bool"
+      variable = "aws:SecureTransport"
+      values   = ["false"]
+    }
+  }
+}
+
+resource "aws_s3_bucket_policy" "failed_logs_backup_https_only" {
+  bucket = aws_s3_bucket.failed_logs_backup.id
+  policy = data.aws_iam_policy_document.failed_logs_backup_https_only.json
+}