feat(ingestion): Deny non-HTTPS traffic to S3 buckets (#8411)

Signed-off-by: germangarces <german.garces@flagsmith.com>
Co-authored-by: flagsmith-engineering[bot] <flagsmith-engineering[bot]@users.noreply.github.com>

Author: germangarces

api/experimentation/ingestion_infra_service.py

@@ -1,5 +1,6 @@
 from __future__ import annotations
 
+import json
 import typing
 from functools import lru_cache
 
@@ -121,6 +122,27 @@ def _create_events_bucket(bucket_name: str, *, organisation_id: int) -> None:
             "RestrictPublicBuckets": True,
         },
     )
+    s3.put_bucket_policy(
+        Bucket=bucket_name,
+        Policy=json.dumps(
+            {
+                "Version": "2012-10-17",
+                "Statement": [
+                    {
+                        "Sid": "AllowSSLRequestsOnly",
+                        "Effect": "Deny",
+                        "Principal": "*",
+                        "Action": "s3:*",
+                        "Resource": [
+                            f"arn:aws:s3:::{bucket_name}",
+                            f"arn:aws:s3:::{bucket_name}/*",
+                        ],
+                        "Condition": {"Bool": {"aws:SecureTransport": "false"}},
+                    }
+                ],
+            }
+        ),
+    )
     s3.put_bucket_lifecycle_configuration(
         Bucket=bucket_name,
         LifecycleConfiguration={

api/tests/unit/experimentation/test_ingestion_infra_service.py

@@ -1,3 +1,4 @@
+import json
 from collections.abc import Iterator
 from typing import Any
 
@@ -92,6 +93,21 @@ def test_provision_ingestion_infrastructure__fresh_account__creates_bucket_and_s
     tagging = s3.get_bucket_tagging(Bucket=result.bucket_name)
     assert tagging["TagSet"] == [{"Key": "organisation_id", "Value": "42"}]
 
+    policy = json.loads(s3.get_bucket_policy(Bucket=result.bucket_name)["Policy"])
+    assert policy["Statement"] == [
+        {
+            "Sid": "AllowSSLRequestsOnly",
+            "Effect": "Deny",
+            "Principal": "*",
+            "Action": "s3:*",
+            "Resource": [
+                f"arn:aws:s3:::{result.bucket_name}",
+                f"arn:aws:s3:::{result.bucket_name}/*",
+            ],
+            "Condition": {"Bool": {"aws:SecureTransport": "false"}},
+        }
+    ]
+
     firehose = boto3.client("firehose", region_name="eu-west-2")
     stream = firehose.describe_delivery_stream(DeliveryStreamName=result.stream_name)[
         "DeliveryStreamDescription"

docs/docs/deployment-self-hosting/observability/_events-catalogue.md

@@ -207,7 +207,7 @@ Attributes:
 ### `experimentation.ingestion_infra.bucket_created`
 
 Logged at `info` from:
- - `api/experimentation/ingestion_infra_service.py:110`
+ - `api/experimentation/ingestion_infra_service.py:111`
 
 Attributes:
  - `bucket.name`
@@ -216,7 +216,7 @@ Attributes:
 ### `experimentation.ingestion_infra.deprovisioned`
 
 Logged at `info` from:
- - `api/experimentation/ingestion_infra_service.py:267`
+ - `api/experimentation/ingestion_infra_service.py:289`
 
 Attributes:
  - `bucket.name`
@@ -245,7 +245,7 @@ Attributes:
 ### `experimentation.ingestion_infra.stream_created`
 
 Logged at `info` from:
- - `api/experimentation/ingestion_infra_service.py:221`
+ - `api/experimentation/ingestion_infra_service.py:243`
 
 Attributes:
  - `bucket.name`