fix: Use 'Bool' instead of 'StringEquals' for DenyHTTP queue policy #3387
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
This change fixes the
DenyHTTP
SQS queue policy used for Karpenter.It replaces
StringEquals
test byBool
test.Motivation and Context
Several SIEM tools are checking that TLS transit encryption is enabled in the SQS policy.
They are checking that there is a
Bool
condition on theaws:SecureTransport
field set tofalse
.If the test is
StringEquals
, an issue is raised by the tool.In addition, as stated in the example of AWS documentation, the valid test to use for aws:SecureTransport is:
Bool
See example here: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Boolean
Breaking Changes
No.
It just follows the good AWS practices.
How Has This Been Tested?
examples/*
to demonstrate and validate my change(s)examples/*
projectsDeployed the module in AWS and everything is OK.
pre-commit run -a
on my pull request