From 8a2c503da6dfd9e8251a47bc0432ea3beb086f15 Mon Sep 17 00:00:00 2001
From: Frank P Moley III <frankmoley@render.com>
Date: Wed, 5 Aug 2026 13:10:10 -0500
Subject: [PATCH] deny non-TLS requests in the render-audit-logs S3 bucket
 policy

---
 terraform/modules/aws/s3.tf | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/terraform/modules/aws/s3.tf b/terraform/modules/aws/s3.tf
index a8356b7..e047f53 100644
--- a/terraform/modules/aws/s3.tf
+++ b/terraform/modules/aws/s3.tf
@@ -61,7 +61,22 @@ resource "aws_s3_bucket_policy" "render_audit_logs" {
               "s3:x-amz-server-side-encryption" = "AES256"
             }
           }
+        },
+      {
+        Sid       = "Block unencrypted requests",
+        Effect    = "Deny",
+        Principal = "*",
+        Action    = "s3:*",
+        Resource = [
+          "arn:aws:s3:::${aws_s3_bucket.render_audit_logs.id}",
+          "arn:aws:s3:::${aws_s3_bucket.render_audit_logs.id}/*",
+        ],
+        Condition = {
+          Bool = {
+            "aws:SecureTransport" = "false"
+          }
         }
+      },
 
     ],
   })