commitdev/zero-aws-eks-stack

Enable Encryption and SecureTransport on S3 buckets by default

bmonkman opened this issue · 2 comments

bmonkman commented

  1. S3 buckets for assets and Terraform state should have encryption enabled by default through the aws provider resource:
    https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#enable-default-server-side-encryption

  2. And though we don't really access buckets directly we should restrict traffic to HTTPS as well.
    For this we can add aws:SecureTransport to the bucket policy: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_policy
    https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Boolean

sshi100 commented

List of resource o f"aws_s3_bucket":

  • modules/s3_hosting/main.tf:r esource "aws_s3_bucket" "client_assets"
  • modules/cloudtrail/main.tf: resource "aws_s3_bucket" "cloudtrail"
  • bootstrap/remote-state/main.tf: resource "aws_s3_bucket" "terraform_remote_state"
sshi100 commented

By default, the log files delivered by CloudTrail to your bucket are encrypted by Amazon server-side encryption with Amazon S3-managed encryption keys (SSE-S3). To provide a security layer that is directly manageable, you can instead use server-side encryption with AWS KMS–managed keys (SSE-KMS) for your CloudTrail log files.

After certain experimental and discussions, we decided to use default SSE-S3 rather than SSE-KMS (which introduces extra maintenance cost for startups).