Merge pull request #1547 from alphagov/GOVUKAPP-946

Add additional security controls on mobile config bucket
alphagov · Dec 5, 2024 · 51bfe58 · 51bfe58
2 parents f8a4584 + 2bc0e26
commit 51bfe58
Showing 1 changed file with 9 additions and 1 deletion.
diff --git a/terraform/deployments/mobile-backend/config-bucket.tf b/terraform/deployments/mobile-backend/config-bucket.tf
@@ -5,7 +5,8 @@ resource "aws_s3_bucket" "mobile_backend_remote_config" {
 resource "aws_s3_bucket_versioning" "mobile_backend_remote_config" {
   bucket = aws_s3_bucket.mobile_backend_remote_config.id
   versioning_configuration {
-    status = "Enabled"
+    status     = "Enabled"
+    mfa_delete = "Enabled"
   }
 }
 
@@ -32,6 +33,13 @@ data "aws_iam_policy_document" "mobile_backend_remote_config_fastly_read" {
       values = data.fastly_ip_ranges.fastly.cidr_blocks
     }
 
+    condition {
+      test     = "Bool"
+      variable = "aws:SecureTransport"
+
+      values = ["true"]
+    }
+
     principals {
       type        = "AWS"
       identifiers = ["*"]