| 1 | # Region HA spec 1 §6: every box-evidence prefix is create-only and never |
| 2 | # deleted, and the Denies name those prefixes and nothing wider (a broad |
| 3 | # Deny on this bucket once broke every lease release). Each statement is |
| 4 | # checked whole: effect, principal, actions, condition and resources, so |
| 5 | # turning a Deny into an Allow, dropping an action or loosening the |
| 6 | # conditional-write condition fails here. |
| 7 | |
| 8 | mock_provider "aws" {} |
| 9 | |
| 10 | override_resource { |
| 11 | target = aws_s3_bucket.deployment |
| 12 | values = { arn = "arn:aws:s3:::dep" } |
| 13 | } |
| 14 | |
| 15 | variables { |
| 16 | deployment_bucket_name = "dep" |
| 17 | data_bucket_name = "data" |
| 18 | } |
| 19 | |
| 20 | run "evidence_prefixes_are_create_only_and_never_deleted" { |
| 21 | command = plan |
| 22 | |
| 23 | assert { |
| 24 | condition = jsonencode([ |
| 25 | for s in jsondecode(aws_s3_bucket_policy.deployment_box_records.policy).Statement : s if s.Sid == "BoxRecordsAreCreateOnly" |
| 26 | ]) == jsonencode([{ |
| 27 | Action = "s3:PutObject" |
| 28 | Condition = { |
| 29 | Bool = { "s3:ObjectCreationOperation" = "true" } |
| 30 | Null = { "s3:if-none-match" = "true" } |
| 31 | } |
| 32 | Effect = "Deny" |
| 33 | Principal = "*" |
| 34 | Resource = [ |
| 35 | "arn:aws:s3:::dep/control/boxes/*", |
| 36 | "arn:aws:s3:::dep/control/box-volumes/*", |
| 37 | "arn:aws:s3:::dep/control/box-enrollment/*", |
| 38 | "arn:aws:s3:::dep/control/box-fences/*", |
| 39 | ] |
| 40 | Sid = "BoxRecordsAreCreateOnly" |
| 41 | }]) |
| 42 | error_message = "BoxRecordsAreCreateOnly must Deny, to everyone, every PutObject without If-None-Match on exactly the four box-evidence prefixes" |
| 43 | } |
| 44 | |
| 45 | assert { |
| 46 | condition = jsonencode([ |
| 47 | for s in jsondecode(aws_s3_bucket_policy.deployment_box_records.policy).Statement : s if s.Sid == "BoxRecordsAreNeverDeleted" |
| 48 | ]) == jsonencode([{ |
| 49 | Action = ["s3:DeleteObject", "s3:DeleteObjectVersion"] |
| 50 | Effect = "Deny" |
| 51 | Principal = "*" |
| 52 | Resource = [ |
| 53 | "arn:aws:s3:::dep/control/boxes/*", |
| 54 | "arn:aws:s3:::dep/control/box-volumes/*", |
| 55 | "arn:aws:s3:::dep/control/box-enrollment/*", |
| 56 | "arn:aws:s3:::dep/control/box-fences/*", |
| 57 | ] |
| 58 | Sid = "BoxRecordsAreNeverDeleted" |
| 59 | }]) |
| 60 | error_message = "BoxRecordsAreNeverDeleted must Deny, to everyone, both delete actions on exactly the four box-evidence prefixes" |
| 61 | } |
| 62 | } |
| 63 | |
amadan