Skip to content

fix: Use 'Bool' instead of 'StringEquals' for DenyHTTP queue policy #3387

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

julb
Copy link

@julb julb commented Jun 22, 2025

Description

This change fixes the DenyHTTP SQS queue policy used for Karpenter.
It replaces StringEquals test by Bool test.

Motivation and Context

Several SIEM tools are checking that TLS transit encryption is enabled in the SQS policy.
They are checking that there is a Bool condition on the aws:SecureTransport field set to false.
If the test is StringEquals, an issue is raised by the tool.
In addition, as stated in the example of AWS documentation, the valid test to use for aws:SecureTransport is: Bool
See example here: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Boolean

Breaking Changes

No.
It just follows the good AWS practices.

How Has This Been Tested?

  • I have updated at least one of the examples/* to demonstrate and validate my change(s)
  • I have tested and validated these changes using one or more of the provided examples/* projects

Deployed the module in AWS and everything is OK.

  • I have executed pre-commit run -a on my pull request

@julb julb changed the title Use 'Bool' instead of StringEquals for DenyHTTP queue policy fix: use 'Bool' instead of 'StringEquals' for DenyHTTP queue policy Jun 22, 2025
@julb julb changed the title fix: use 'Bool' instead of 'StringEquals' for DenyHTTP queue policy fix: Use 'Bool' instead of 'StringEquals' for DenyHTTP queue policy Jun 22, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant