Skip to content

Commit

Permalink
feat: Add SQS queue resource policy to improve security (philips-labs…
Browse files Browse the repository at this point in the history
…#1798)

* feat: added sqs queue resource policy to improve security

* added policy to deny all actions on queue with unsecured transport method

* chore: formatted main.tf
  • Loading branch information
julada authored Mar 10, 2022
1 parent 8f9c342 commit 96def9a
Showing 1 changed file with 38 additions and 0 deletions.
38 changes: 38 additions & 0 deletions main.tf
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,38 @@ resource "random_string" "random" {
upper = false
}

data "aws_iam_policy_document" "deny_unsecure_transport" {
statement {
sid = "DenyUnsecureTransport"

effect = "Deny"

principals {
type = "AWS"
identifiers = ["*"]
}

actions = [
"sqs:*"
]

resources = [
"*"
]

condition {
test = "Bool"
variable = "aws:SecureTransport"
values = ["false"]
}
}
}

resource "aws_sqs_queue_policy" "build_queue_policy" {
queue_url = aws_sqs_queue.queued_builds.id
policy = data.aws_iam_policy_document.deny_unsecure_transport.json
}

resource "aws_sqs_queue" "queued_builds" {
name = "${var.environment}-queued-builds${var.fifo_build_queue ? ".fifo" : ""}"
delay_seconds = var.delay_webhook_event
Expand All @@ -33,6 +65,12 @@ resource "aws_sqs_queue" "queued_builds" {
tags = var.tags
}


resource "aws_sqs_queue_policy" "build_queue_dlq_policy" {
queue_url = aws_sqs_queue.queued_builds.id
policy = data.aws_iam_policy_document.deny_unsecure_transport.json
}

resource "aws_sqs_queue" "queued_builds_dlq" {
count = var.redrive_build_queue.enabled ? 1 : 0
name = "${var.environment}-queued-builds_dead_letter"
Expand Down

0 comments on commit 96def9a

Please sign in to comment.