enforce S3-SSE requests to CloudTrail bucket

widdix · Feb 8, 2024 · 71a8deb · 71a8deb
1 parent 8915460
commit 71a8deb
Showing 1 changed file with 10 additions and 0 deletions.
diff --git a/security/cloudtrail.yaml b/security/cloudtrail.yaml
@@ -215,6 +215,16 @@ Resources:
           Condition:
             Bool:
               'aws:SecureTransport': false
+        - Sid: EnforceSSERequests
+          Effect: Deny
+          Principal: '*'
+          Action: 's3:PutObject'
+          Resource: !If [HasLogFilePrefix, !Sub 'arn:aws:s3:::${TrailBucket}/${LogFilePrefix}/AWSLogs/${AWS::AccountId}/*', !Sub 'arn:aws:s3:::${TrailBucket}/AWSLogs/${AWS::AccountId}/*']
+          Condition:
+            StringNotEquals:
+              's3:x-amz-server-side-encryption':
+                - 'AES256'
+                - 'aws:kms'
   TrailLogGroup:
     Type: 'AWS::Logs::LogGroup'
     Properties: