Skip to content

Commit 6f318b5

Browse files
PatMyronPatMyron
authored
chore(synthetics): enforceSSL on canary s3 ArtifactsBucket (#18269)
could pass another bucket, but automatically created buckets are convenient/popular, so worth improving defaults https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-synthetics.Canary.html https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-s3.Bucket.html --- ```sh # updated integ snapshots packages/@aws-cdk/aws-synthetics $ /workspace/aws-cdk/tools/\@aws-cdk/cdk-integ-tools/bin/cdk-integ --dry-run ``` ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
1 parent 93cd776 commit 6f318b5

File tree

2 files changed

+189
-0
lines changed

2 files changed

+189
-0
lines changed

‎packages/@aws-cdk/aws-synthetics/lib/canary.ts

+1
Original file line numberDiff line numberDiff line change
@@ -226,6 +226,7 @@ export class Canary extends cdk.Resource {
226226

227227
this.artifactsBucket = props.artifactsBucketLocation?.bucket ?? new s3.Bucket(this, 'ArtifactsBucket', {
228228
encryption: s3.BucketEncryption.KMS_MANAGED,
229+
enforceSSL: true,
229230
});
230231

231232
this.role = props.role ?? this.createDefaultRole(props.artifactsBucketLocation?.prefix);

‎packages/@aws-cdk/aws-synthetics/test/integ.canary.expected.json

+188
Original file line numberDiff line numberDiff line change
@@ -138,6 +138,53 @@
138138
"UpdateReplacePolicy": "Retain",
139139
"DeletionPolicy": "Retain"
140140
},
141+
"MyCanaryOneArtifactsBucketPolicyA2B99545": {
142+
"Type": "AWS::S3::BucketPolicy",
143+
"Properties": {
144+
"Bucket": {
145+
"Ref": "MyCanaryOneArtifactsBucketDF4A487D"
146+
},
147+
"PolicyDocument": {
148+
"Statement": [
149+
{
150+
"Action": "s3:*",
151+
"Condition": {
152+
"Bool": {
153+
"aws:SecureTransport": "false"
154+
}
155+
},
156+
"Effect": "Deny",
157+
"Principal": {
158+
"AWS": "*"
159+
},
160+
"Resource": [
161+
{
162+
"Fn::GetAtt": [
163+
"MyCanaryOneArtifactsBucketDF4A487D",
164+
"Arn"
165+
]
166+
},
167+
{
168+
"Fn::Join": [
169+
"",
170+
[
171+
{
172+
"Fn::GetAtt": [
173+
"MyCanaryOneArtifactsBucketDF4A487D",
174+
"Arn"
175+
]
176+
},
177+
"/*"
178+
]
179+
]
180+
}
181+
]
182+
}
183+
],
184+
"Version": "2012-10-17"
185+
}
186+
}
187+
},
141188
"MyCanaryOneServiceRole41995561": {
142189
"Type": "AWS::IAM::Role",
143190
"Properties": {
@@ -305,6 +352,53 @@
305352
"UpdateReplacePolicy": "Retain",
306353
"DeletionPolicy": "Retain"
307354
},
355+
"MyCanaryTwoArtifactsBucketPolicy4719E279": {
356+
"Type": "AWS::S3::BucketPolicy",
357+
"Properties": {
358+
"Bucket": {
359+
"Ref": "MyCanaryTwoArtifactsBucket79B179B6"
360+
},
361+
"PolicyDocument": {
362+
"Statement": [
363+
{
364+
"Action": "s3:*",
365+
"Condition": {
366+
"Bool": {
367+
"aws:SecureTransport": "false"
368+
}
369+
},
370+
"Effect": "Deny",
371+
"Principal": {
372+
"AWS": "*"
373+
},
374+
"Resource": [
375+
{
376+
"Fn::GetAtt": [
377+
"MyCanaryTwoArtifactsBucket79B179B6",
378+
"Arn"
379+
]
380+
},
381+
{
382+
"Fn::Join": [
383+
"",
384+
[
385+
{
386+
"Fn::GetAtt": [
387+
"MyCanaryTwoArtifactsBucket79B179B6",
388+
"Arn"
389+
]
390+
},
391+
"/*"
392+
]
393+
]
394+
}
395+
]
396+
}
397+
],
398+
"Version": "2012-10-17"
399+
}
400+
}
401+
},
308402
"MyCanaryTwoServiceRole041E85D4": {
309403
"Type": "AWS::IAM::Role",
310404
"Properties": {
@@ -472,6 +566,53 @@
472566
"UpdateReplacePolicy": "Retain",
473567
"DeletionPolicy": "Retain"
474568
},
569+
"MyCanaryThreeArtifactsBucketPolicy568A97F7": {
570+
"Type": "AWS::S3::BucketPolicy",
571+
"Properties": {
572+
"Bucket": {
573+
"Ref": "MyCanaryThreeArtifactsBucket894E857E"
574+
},
575+
"PolicyDocument": {
576+
"Statement": [
577+
{
578+
"Action": "s3:*",
579+
"Condition": {
580+
"Bool": {
581+
"aws:SecureTransport": "false"
582+
}
583+
},
584+
"Effect": "Deny",
585+
"Principal": {
586+
"AWS": "*"
587+
},
588+
"Resource": [
589+
{
590+
"Fn::GetAtt": [
591+
"MyCanaryThreeArtifactsBucket894E857E",
592+
"Arn"
593+
]
594+
},
595+
{
596+
"Fn::Join": [
597+
"",
598+
[
599+
{
600+
"Fn::GetAtt": [
601+
"MyCanaryThreeArtifactsBucket894E857E",
602+
"Arn"
603+
]
604+
},
605+
"/*"
606+
]
607+
]
608+
}
609+
]
610+
}
611+
],
612+
"Version": "2012-10-17"
613+
}
614+
}
615+
},
475616
"MyCanaryThreeServiceRole68117E65": {
476617
"Type": "AWS::IAM::Role",
477618
"Properties": {
@@ -639,6 +780,53 @@
639780
"UpdateReplacePolicy": "Retain",
640781
"DeletionPolicy": "Retain"
641782
},
783+
"MyPythonCanaryArtifactsBucketPolicy7E13B7C5": {
784+
"Type": "AWS::S3::BucketPolicy",
785+
"Properties": {
786+
"Bucket": {
787+
"Ref": "MyPythonCanaryArtifactsBucket7AE88133"
788+
},
789+
"PolicyDocument": {
790+
"Statement": [
791+
{
792+
"Action": "s3:*",
793+
"Condition": {
794+
"Bool": {
795+
"aws:SecureTransport": "false"
796+
}
797+
},
798+
"Effect": "Deny",
799+
"Principal": {
800+
"AWS": "*"
801+
},
802+
"Resource": [
803+
{
804+
"Fn::GetAtt": [
805+
"MyPythonCanaryArtifactsBucket7AE88133",
806+
"Arn"
807+
]
808+
},
809+
{
810+
"Fn::Join": [
811+
"",
812+
[
813+
{
814+
"Fn::GetAtt": [
815+
"MyPythonCanaryArtifactsBucket7AE88133",
816+
"Arn"
817+
]
818+
},
819+
"/*"
820+
]
821+
]
822+
}
823+
]
824+
}
825+
],
826+
"Version": "2012-10-17"
827+
}
828+
}
829+
},
642830
"MyPythonCanaryServiceRole41A363E1": {
643831
"Type": "AWS::IAM::Role",
644832
"Properties": {

0 commit comments

Comments
 (0)