v0.3.0 — End-to-end tested

What's Changed

Three bugs discovered and fixed during end-to-end smoke testing:

Fixed

• S3 bucket policy StringNotEqualsIfExists incorrect for Deny statements — The v0.2.1 fix was wrong: StringNotEqualsIfExists on a Deny evaluates to true when the condition key is absent, which still blocks uploads without explicit encryption headers. Replaced with StringNotEquals + Null condition guard across all three buckets (6 statements). The Deny now only fires when the header is explicitly present with a non-KMS value; absent headers fall through to bucket default SSE-KMS.

• SFTP user IAM trust policy used wrong ARN type — Transfer Family passes a user ARN (arn:aws:transfer:region:account:user/server-id/username), not a server ARN, when assuming the data access role. Changed aws:SourceArn from server/* to user/server-id/*.

• SFTP ListBucket condition too restrictive — The s3:prefix condition only allowed uploads/dave/* but Transfer Family also needs to stat the home directory prefix itself (uploads/dave without trailing slash). Added the bare prefix as a second allowed value.

Verified

End-to-end pipeline tested:

Test	GuardDuty Result	Lambda Route	SNS Alert
Clean text file (SFTP upload)	NO_THREATS_FOUND	→ egress bucket	No
EICAR test file (SFTP upload)	THREATS_FOUND	→ quarantine bucket	Yes (email delivered)
SFTP egress download	—	File downloaded successfully	—

Full Changelog: v0.2.2...v0.3.0