From bf97960db5683f716cf48fff24e75a9a9557ad98 Mon Sep 17 00:00:00 2001
From: jalawala <jalawala@example.com>
Date: Wed, 1 Jul 2026 14:58:27 +0530
Subject: [PATCH] Enforce HTTPS-only access on CodePipeline S3 buckets

Resolves AppSec finding acat-cfnlint.EA013 (S3 bucket policy allows
non-secure transport) in static/inspector-codepipeline.yaml:

- CodePipelineArtifactStoreBucketPolicy: extend DenyInsecureConnections
  to cover the bucket-level ARN in addition to bucket/* (object) ARN, so
  bucket-level calls over HTTP are also denied.
- CodePipelineArtifactBucket: add a new bucket policy with an equivalent
  aws:SecureTransport=false deny; it previously had no policy at all.

Ticket: V2268145424
---
 static/inspector-codepipeline.yaml | 21 ++++++++++++++++++++-
 1 file changed, 20 insertions(+), 1 deletion(-)

diff --git a/static/inspector-codepipeline.yaml b/static/inspector-codepipeline.yaml
index 0b5f128..90ec29c 100644
--- a/static/inspector-codepipeline.yaml
+++ b/static/inspector-codepipeline.yaml
@@ -54,6 +54,24 @@ Resources:
   CodePipelineArtifactBucket:
     Type: AWS::S3::Bucket
 
+  CodePipelineArtifactBucketPolicy:
+    Type: AWS::S3::BucketPolicy
+    Properties:
+      Bucket: !Ref CodePipelineArtifactBucket
+      PolicyDocument:
+        Version: 2012-10-17
+        Statement:
+          - Sid: DenyInsecureConnections
+            Effect: Deny
+            Principal: "*"
+            Action: s3:*
+            Resource:
+              - !GetAtt CodePipelineArtifactBucket.Arn
+              - !Join ["", [!GetAtt CodePipelineArtifactBucket.Arn, "/*"]]
+            Condition:
+              Bool:
+                aws:SecureTransport: false
+
   ContainerComponentsRepo:
     Type: AWS::CodeCommit::Repository
     Properties:
@@ -171,7 +189,8 @@ Resources:
             Principal: "*"
             Action: s3:*
             Resource:
-              !Join ["", [!GetAtt CodePipelineArtifactStoreBucket.Arn, "/*"]]
+              - !GetAtt CodePipelineArtifactStoreBucket.Arn
+              - !Join ["", [!GetAtt CodePipelineArtifactStoreBucket.Arn, "/*"]]
             Condition:
               Bool:
                 aws:SecureTransport: false