feat(ingestion): Deny non-HTTPS traffic to S3 buckets

[germangarces]

Thanks for submitting a PR! Please check the boxes below:

• I have read the Contributing Guide.
• I have added information to docs/ if required so people know about the feature.
• I have filled in the "Changes" section below.
• I have filled in the "How did you test this code" section below.

Changes

S3 buckets allow only HTTPS traffic (AWS)

How did you test this code?

Added a test that checks that the policy is attached to the S3 bucket.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview	Aug 31, 2026 10:30am

2 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
flagsmith-frontend-preview	Ignored	Preview	Aug 31, 2026 10:30am
flagsmith-frontend-staging	Ignored	Preview	Aug 31, 2026 10:30am

[github-actions]

Docker builds report

Image	Build Status	Security report
ghcr.io/flagsmith/flagsmith-e2e:pr-8411	Finished ✅	Skipped
ghcr.io/flagsmith/flagsmith-api-test:pr-8411	Finished ✅	Skipped
ghcr.io/flagsmith/flagsmith-frontend:pr-8411	Finished ✅	Results ✅
ghcr.io/flagsmith/flagsmith-api:pr-8411	Finished ✅	Results ✅
ghcr.io/flagsmith/flagsmith:pr-8411	Finished ✅	Results ✅
ghcr.io/flagsmith/flagsmith-private-cloud:pr-8411	Finished ✅	Results ✅

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 52452d21-5f65-4229-8fac-f3278ca15104

📥 Commits

Reviewing files that changed from the base of the PR and between 4aec8dd and 1814c12.

📒 Files selected for processing (3)

• api/experimentation/ingestion_infra_service.py
• api/tests/unit/experimentation/test_ingestion_infra_service.py
• docs/docs/deployment-self-hosting/observability/_events-catalogue.md

Included review availability: Your plan provides up to 8 included reviews per hour; 7 remain after this review.

---

📝 Walkthrough

Walkthrough

The ingestion infrastructure now applies an S3 bucket policy that denies all S3 actions over insecure transport for the bucket and its objects. Unit tests parse the policy and verify both resource patterns. The events catalogue updates source line references for three experimentation ingestion infrastructure events.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: 🟡 Moderate · up to 1814c

This change blocks non-HTTPS access for newly provisioned S3 buckets, but existing buckets are not updated and a provisioning failure can leave a bucket without the protection or a reliable cleanup path. Merge should wait for lifecycle reconciliation and failure recovery to be addressed or explicitly accepted by the owner.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ private-cloud · depot-ubuntu-latest-arm-16 — run #19961 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

 23 passed
 1 skipped

Details

 24 tests across 18 suites
 1 minute, 54 seconds
 dc24f92
 🔄 Run: #19961 (attempt 1)

Skipped tests

firefox › tests/onboarding-tests.pw.ts › Onboarding › New user connects via the single-page onboarding flow @oss

🗂️ Previous results

✅ private-cloud · depot-ubuntu-latest-16 — run #19961 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

 3 passed

Details

 3 tests across 3 suites
 32.7 seconds
 dc24f92
 🔄 Run: #19961 (attempt 1)

✅ oss · depot-ubuntu-latest-arm-16 — run #19962 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

 1 passed

Details

 1 test across 1 suite
 58.2 seconds
 1814c12
 🔄 Run: #19962 (attempt 1)

✅ oss · depot-ubuntu-latest-arm-16 — run #19961 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

 1 passed

Details

 1 test across 1 suite
 47.9 seconds
 dc24f92
 🔄 Run: #19961 (attempt 1)

✅ oss · depot-ubuntu-latest-16 — run #19961 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-16)

 1 passed

Details

 1 test across 1 suite
 41.8 seconds
 dc24f92
 🔄 Run: #19961 (attempt 1)

✅ oss · depot-ubuntu-latest-16 — run #19962 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-16)

 1 passed

Details

 1 test across 1 suite
 33.5 seconds
 1814c12
 🔄 Run: #19962 (attempt 1)

[github-actions]

Visual Regression

19 screenshots compared. See report for details.
View full report

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.81%. Comparing base (4aec8dd) to head (1814c12).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #8411   +/-   ##
=======================================
  Coverage   98.81%   98.81%           
=======================================
  Files        1621     1621           
  Lines       66104    66109    +5     
=======================================
+ Hits        65320    65325    +5     
  Misses        784      784           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.