fix(s3): SSL enforcement doesn't apply on top level bucket requests (a…

…ws#13961) Fixes aws#13760 ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
Samrose-Ahmed · Apr 8, 2021 · d0e831a · d0e831a
1 parent c6a6fde
commit d0e831a
Show file tree

Hide file tree

Showing 2 changed files with 25 additions and 14 deletions.
diff --git a/packages/@aws-cdk/aws-s3/lib/bucket.ts b/packages/@aws-cdk/aws-s3/lib/bucket.ts
@@ -1502,7 +1502,10 @@ export class Bucket extends BucketBase {
         Bool: { 'aws:SecureTransport': 'false' },
       },
       effect: iam.Effect.DENY,
-      resources: [this.arnForObjects('*')],
+      resources: [
+        this.bucketArn,
+        this.arnForObjects('*'),
+      ],
       principals: [new iam.AnyPrincipal()],
     });
     this.addToResourcePolicy(statement);

diff --git a/packages/@aws-cdk/aws-s3/test/bucket.test.ts b/packages/@aws-cdk/aws-s3/test/bucket.test.ts
@@ -307,20 +307,28 @@ describe('bucket', () => {
                   },
                   'Effect': 'Deny',
                   'Principal': '*',
-                  'Resource': {
-                    'Fn::Join': [
-                      '',
-                      [
-                        {
-                          'Fn::GetAtt': [
-                            'MyBucketF68F3FF0',
-                            'Arn',
-                          ],
-                        },
-                        '/*',
+                  'Resource': [
+                    {
+                      'Fn::GetAtt': [
+                        'MyBucketF68F3FF0',
+                        'Arn',
                       ],
-                    ],
-                  },
+                    },
+                    {
+                      'Fn::Join': [
+                        '',
+                        [
+                          {
+                            'Fn::GetAtt': [
+                              'MyBucketF68F3FF0',
+                              'Arn',
+                            ],
+                          },
+                          '/*',
+                        ],
+                      ],
+                    },
+                  ],
                 },
               ],
               'Version': '2012-10-17',