feat: enable encryption

PedakiHQ · Dec 25, 2023 · a72a468 · a72a468
1 parent 3df2a05
commit a72a468
Show file tree

Hide file tree

Showing 3 changed files with 40 additions and 3 deletions.
diff --git a/aws/policies/pulumi.json b/aws/policies/pulumi.json
@@ -10,6 +10,7 @@
         "s3:List*",
         "s3:PutBucketPublicAccessBlock",
         "s3:PutBucketPolicy",
+        "s3:PutEncryptionConfiguration",
         "s3:DeleteBucketPolicy"
       ],
       "Resource": [

diff --git a/src/aws/resources/files-bucket.ts b/src/aws/resources/files-bucket.ts
@@ -6,16 +6,52 @@ export const createFilesBucket = () => {
   const bucket = new aws.s3.Bucket('files.pedaki.fr', {
     bucket: 'files.pedaki.fr',
     acl: 'private',
+    serverSideEncryptionConfiguration: {
+      rule: {
+        applyServerSideEncryptionByDefault: {
+          sseAlgorithm: 'aws:kms',
+        },
+        bucketKeyEnabled: true,
+      },
+    },
   });
 
-  const publicAccessBlock = new aws.s3.BucketPublicAccessBlock('publicAccessBlock', {
+  const publicAccessBlock = new aws.s3.BucketPublicAccessBlock('files.pedaki.fr-publicAccessBlock', {
     bucket: bucket.id,
     blockPublicAcls: true,
     blockPublicPolicy: true,
     ignorePublicAcls: true,
     restrictPublicBuckets: true,
   });
 
+  const policy = new aws.s3.BucketPolicy(
+    'files-bucket-policy',
+    {
+      bucket: bucket.id,
+      policy: bucket.arn.apply(arn =>
+        JSON.stringify({
+          // all files should be encrypted
+          Version: '2012-10-17',
+          Statement: [
+            {
+              Sid: 'DenyUnEncryptedObjectUploads',
+              Effect: 'Deny',
+              Principal: '*',
+              Action: 's3:PutObject',
+              Resource: `${arn}/*`,
+              Condition: {
+                StringNotEquals: {
+                  's3:x-amz-server-side-encryption': 'aws:kms',
+                },
+              },
+            },
+          ],
+        }),
+      ),
+    },
+    { dependsOn: [publicAccessBlock] },
+  );
+
   const record = new cloudflare.Record('files.pedaki.fr', {
     name: 'files',
     type: 'CNAME',

diff --git a/src/aws/resources/static-bucket.ts b/src/aws/resources/static-bucket.ts
@@ -7,7 +7,7 @@ export const createStaticBucket = () => {
     bucket: 'static.pedaki.fr',
   });
 
-  const publicAccessBlock = new aws.s3.BucketPublicAccessBlock('publicAccessBlock', {
+  const publicAccessBlock = new aws.s3.BucketPublicAccessBlock('static.pedaki.fr-publicAccessBlock', {
     bucket: bucket.id,
     blockPublicAcls: false,
     blockPublicPolicy: false,
@@ -16,7 +16,7 @@ export const createStaticBucket = () => {
   });
 
   const _ = new aws.s3.BucketPolicy(
-    'bucket-policy',
+    'static-bucket-policy',
     {
       bucket: bucket.id,
       policy: bucket.arn.apply(arn =>