Add default AES256 encryption and enable versioning to buckets (#3673)

aws · May 4, 2023 · 04e734a · 04e734a
1 parent 66ee03d
commit 04e734a
Show file tree

Hide file tree

Showing 3 changed files with 18 additions and 0 deletions.
diff --git a/build-infrastructure/audit-logs-stack.yml b/build-infrastructure/audit-logs-stack.yml
@@ -51,6 +51,12 @@ Resources:
     Type: AWS::S3::BucketPolicy
     Properties:
       Bucket: !Sub 'audit-logs-bucket-${AWS::AccountId}'
+      BucketEncryption:
+        ServerSideEncryptionConfiguration:
+          - ServerSideEncryptionByDefault:
+              SSEAlgorithm: AES256
+      VersioningConfiguration:
+        Status: Enabled
       PolicyDocument:
         Version: 2012-10-17
         Statement:

diff --git a/build-infrastructure/release-pipeline-stack.yml b/build-infrastructure/release-pipeline-stack.yml
@@ -117,6 +117,12 @@ Resources:
     Type: AWS::S3::Bucket
     Properties:
       BucketName: !Sub 'codepipeline-${AWS::Region}-${AWS::AccountId}-artifacts'
+      BucketEncryption:
+        ServerSideEncryptionConfiguration:
+          - ServerSideEncryptionByDefault:
+              SSEAlgorithm: AES256
+      VersioningConfiguration:
+        Status: Enabled
       PublicAccessBlockConfiguration:
         BlockPublicAcls: true
         BlockPublicPolicy: true

diff --git a/build-infrastructure/staging-bucket-stack.yml b/build-infrastructure/staging-bucket-stack.yml
@@ -16,6 +16,12 @@ Resources:
     Type: AWS::S3::Bucket
     Properties:
       BucketName: !Sub '${StagingBucketNamePrefix}-${AWS::Region}-${AWS::AccountId}'
+      BucketEncryption:
+        ServerSideEncryptionConfiguration:
+          - ServerSideEncryptionByDefault:
+              SSEAlgorithm: AES256
+      VersioningConfiguration:
+        Status: Enabled
 
   StagingArtifactsBucketPolicy:
     Type: AWS::S3::BucketPolicy