feat(s3): specify minimum TLS version

aws · Sep 26, 2023 · 9f507e1 · 9f507e1
1 parent 3196733
commit 9f507e1
Show file tree

Hide file tree

Showing 12 changed files with 710 additions and 0 deletions.
diff --git a/...t/integ.bucket-minimum-tls-version.js.snapshot/aws-cdk-s3-minimum-tls-version.assets.json b/...t/integ.bucket-minimum-tls-version.js.snapshot/aws-cdk-s3-minimum-tls-version.assets.json
diff --git a/...integ.bucket-minimum-tls-version.js.snapshot/aws-cdk-s3-minimum-tls-version.template.json b/...integ.bucket-minimum-tls-version.js.snapshot/aws-cdk-s3-minimum-tls-version.template.json
@@ -0,0 +1,124 @@
+{
+ "Resources": {
+  "Bucket83908E77": {
+   "Type": "AWS::S3::Bucket",
+   "UpdateReplacePolicy": "Retain",
+   "DeletionPolicy": "Retain"
+  },
+  "BucketPolicyE9A3008A": {
+   "Type": "AWS::S3::BucketPolicy",
+   "Properties": {
+    "Bucket": {
+     "Ref": "Bucket83908E77"
+    },
+    "PolicyDocument": {
+     "Statement": [
+      {
+       "Action": "s3:*",
+       "Condition": {
+        "Bool": {
+         "aws:SecureTransport": "false"
+        }
+       },
+       "Effect": "Deny",
+       "Principal": {
+        "AWS": "*"
+       },
+       "Resource": [
+        {
+         "Fn::GetAtt": [
+          "Bucket83908E77",
+          "Arn"
+         ]
+        },
+        {
+         "Fn::Join": [
+          "",
+          [
+           {
+            "Fn::GetAtt": [
+             "Bucket83908E77",
+             "Arn"
+            ]
+           },
+           "/*"
+          ]
+         ]
+        }
+       ]
+      },
+      {
+       "Action": "s3:*",
+       "Condition": {
+        "NumericLessThan": {
+         "s3:TlsVersion": 1.2
+        }
+       },
+       "Effect": "Deny",
+       "Principal": {
+        "AWS": "*"
+       },
+       "Resource": [
+        {
+         "Fn::GetAtt": [
+          "Bucket83908E77",
+          "Arn"
+         ]
+        },
+        {
+         "Fn::Join": [
+          "",
+          [
+           {
+            "Fn::GetAtt": [
+             "Bucket83908E77",
+             "Arn"
+            ]
+           },
+           "/*"
+          ]
+         ]
+        }
+       ]
+      }
+     ],
+     "Version": "2012-10-17"
+    }
+   }
+  }
+ },
+ "Parameters": {
+  "BootstrapVersion": {
+   "Type": "AWS::SSM::Parameter::Value<String>",
+   "Default": "/cdk-bootstrap/hnb659fds/version",
+   "Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"
+  }
+ },
+ "Rules": {
+  "CheckBootstrapVersion": {
+   "Assertions": [
+    {
+     "Assert": {
+      "Fn::Not": [
+       {
+        "Fn::Contains": [
+         [
+          "1",
+          "2",
+          "3",
+          "4",
+          "5"
+         ],
+         {
+          "Ref": "BootstrapVersion"
+         }
+        ]
+       }
+      ]
+     },
+     "AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."
+    }
+   ]
+  }
+ }
+}
diff --git a/....snapshot/awscdks3minimumtlsversionintegrationDefaultTestDeployAssert7BC7B4EF.assets.json b/....snapshot/awscdks3minimumtlsversionintegrationDefaultTestDeployAssert7BC7B4EF.assets.json
diff --git a/...napshot/awscdks3minimumtlsversionintegrationDefaultTestDeployAssert7BC7B4EF.template.json b/...napshot/awscdks3minimumtlsversionintegrationDefaultTestDeployAssert7BC7B4EF.template.json
diff --git a/...ing/framework-integ/test/aws-s3/test/integ.bucket-minimum-tls-version.js.snapshot/cdk.out b/...ing/framework-integ/test/aws-s3/test/integ.bucket-minimum-tls-version.js.snapshot/cdk.out
diff --git a/.../framework-integ/test/aws-s3/test/integ.bucket-minimum-tls-version.js.snapshot/integ.json b/.../framework-integ/test/aws-s3/test/integ.bucket-minimum-tls-version.js.snapshot/integ.json
diff --git a/...amework-integ/test/aws-s3/test/integ.bucket-minimum-tls-version.js.snapshot/manifest.json b/...amework-integ/test/aws-s3/test/integ.bucket-minimum-tls-version.js.snapshot/manifest.json