v0.2.1

What's Changed

Fixed

• S3 bucket policy blocks AWS service uploads — Changed StringNotEquals to StringNotEqualsIfExists in DenyNonKMSEncryption and DenyWrongKMSKey policy statements across all three buckets (ingress, egress, quarantine). Services that rely on bucket default encryption and omit x-amz-server-side-encryption headers (e.g. AWS Transfer Family, GuardDuty, Lambda) were getting AccessDenied. The IfExists variant only evaluates the condition when the header is present, allowing headless uploads to fall through to bucket default SSE-KMS.

Changed

• Bucket names include hashed account ID for global uniqueness — S3 bucket names changed from <prefix>-<type> to <prefix>-<hash>-<type> where <hash> is the first 8 characters of sha256(account_id). This prevents name collisions across AWS accounts without exposing the raw account ID. Breaking change: existing buckets will be recreated.

• IAM wildcards replaced with explicit actions — kms:GenerateDataKey*, kms:ReEncrypt*, transfer:*, and ec2:* replaced with enumerated action lists in the KMS key policy and README SCP recommendations.

Upgrading

This release contains two breaking changes:

1. Bucket names changed — All four buckets (ingress, egress, quarantine, logs) now include an account hash in the name. Terraform will plan to destroy and recreate them. Back up your data before upgrading or use terraform state mv to migrate.

2. KMS key policy updated — The AllowServiceUsage statement now uses explicit actions instead of wildcards. This is a non-destructive policy update.

Full Changelog: v0.2.0...v0.2.1