feat(aws-s3): adds s3 bucket aws fsbp option

packages/@aws-cdk/aws-s3/lib/bucket.ts

@@ -1012,6 +1012,14 @@ export interface BucketProps {
    */
   readonly encryptionKey?: kms.IKey;
 
+  /**
+  * Enforces SSL for requests. S3.5 of the AWS Foundational Security Best Practices Regarding S3.
+  * @see https://docs.aws.amazon.com/config/latest/developerguide/s3-bucket-ssl-requests-only.html
+  *
+  * @default false
+  */
+  readonly enforceSSL?: boolean;
+
   /**
    * Physical name of this bucket.
    *
@@ -1225,6 +1233,8 @@ export class Bucket extends BucketBase {
   private accessControl?: BucketAccessControl;
   private readonly lifecycleRules: LifecycleRule[] = [];
   private readonly versioned?: boolean;
+  private readonly enforceSSL?: boolean;
+  private readonly blockPublicAccess: BlockPublicAccess | undefined;
   private readonly notifications: BucketNotifications;
   private readonly metrics: BucketMetrics[] = [];
   private readonly cors: CorsRule[] = [];
@@ -1238,6 +1248,8 @@ export class Bucket extends BucketBase {
     const { bucketEncryption, encryptionKey } = this.parseEncryption(props);
 
     this.validateBucketName(this.physicalName);
+    this.blockPublicAccess = props.blockPublicAccess;
+    this.enforceSSL = props.enforceSSL;
 
     const websiteConfiguration = this.renderWebsiteConfiguration(props);
     this.isWebsite = (websiteConfiguration !== undefined);
@@ -1275,9 +1287,14 @@ export class Bucket extends BucketBase {
     this.bucketDualStackDomainName = resource.attrDualStackDomainName;
     this.bucketRegionalDomainName = resource.attrRegionalDomainName;
 
-    this.disallowPublicAccess = props.blockPublicAccess && props.blockPublicAccess.blockPublicPolicy;
+    this.disallowPublicAccess = this.blockPublicAccess && this.blockPublicAccess.blockPublicPolicy;
     this.accessControl = props.accessControl;
 
+    // Enforce AWS Foundational Security Best Practice
+    if (this.enforceSSL) {
+      this.enforceSSLStatement();
+    }
+
     if (props.serverAccessLogsBucket instanceof Bucket) {
       props.serverAccessLogsBucket.allowLogDelivery();
     }
@@ -1392,6 +1409,22 @@ export class Bucket extends BucketBase {
     this.inventories.push(inventory);
   }
 
+  /**
+   * Adds an iam statement to enforce SSL requests only.
+   */
+  private enforceSSLStatement() {
+    const statement = new iam.PolicyStatement({
+      actions: ['s3:*'],
+      conditions: {
+        Bool: { 'aws:SecureTransport': 'false' },
+      },
+      effect: iam.Effect.DENY,
+      resources: [this.arnForObjects('*')],
+      principals: [new iam.AnyPrincipal()],
+    });
+    this.addToResourcePolicy(statement);
+  }
+
   private validateBucketName(physicalName: string): void {
     const bucketName = physicalName;
     if (!bucketName || Token.isUnresolved(bucketName)) {

packages/@aws-cdk/aws-s3/test/bucket.test.ts

@@ -495,6 +495,62 @@ nodeunitShim({
       test.done();
     },
 
+    'bucket with aws foundational security best practice enforce ssl'(test: Test) {
+      const stack = new cdk.Stack();
+      new s3.Bucket(stack, 'MyBucket', {
+        enforceSSL: true,
+      });
+
+      expect(stack).toMatch({
+        'Resources': {
+          'MyBucketF68F3FF0': {
+            'Type': 'AWS::S3::Bucket',
+            'UpdateReplacePolicy': 'Retain',
+            'DeletionPolicy': 'Retain',
+          },
+          'MyBucketPolicyE7FBAC7B': {
+            'Type': 'AWS::S3::BucketPolicy',
+            'Properties': {
+              'Bucket': {
+                'Ref': 'MyBucketF68F3FF0',
+              },
+              'PolicyDocument': {
+                'Statement': [
+                  {
+                    'Action': 's3:*',
+                    'Condition': {
+                      'Bool': {
+                        'aws:SecureTransport': 'false',
+                      },
+                    },
+                    'Effect': 'Deny',
+                    'Principal': '*',
+                    'Resource': {
+                      'Fn::Join': [
+                        '',
+                        [
+                          {
+                            'Fn::GetAtt': [
+                              'MyBucketF68F3FF0',
+                              'Arn',
+                            ],
+                          },
+                          '/*',
+                        ],
+                      ],
+                    },
+                  },
+                ],
+                'Version': '2012-10-17',
+              },
+            },
+          },
+        },
+      });
+
+      test.done();
+    },
+
     'forBucket returns a permission statement associated with the bucket\'s ARN'(test: Test) {
       const stack = new cdk.Stack();