fix(AWS Deploy): Improve S3 bucket policy security (#8542)

serverless · Nov 24, 2020 · 2a9b57b · 2a9b57b
1 parent 445369e
commit 2a9b57b
Show file tree

Hide file tree

Showing 3 changed files with 18 additions and 1 deletion.
diff --git a/lib/plugins/aws/deploy/lib/checkForChanges.test.js b/lib/plugins/aws/deploy/lib/checkForChanges.test.js
@@ -1089,7 +1089,7 @@ describe('checkForChanges #2', () => {
                   'serverless/test-package-artifact/dev/1589988704359-2020-05-20T15:31:44.359Z/compiled-cloudformation-template.json',
               })
               .returns({
-                Metadata: { filesha256: 'GqTahQAAhwcDCqdXMSfmMNHTQodNZ2NLj8MEoMsk8i0=' },
+                Metadata: { filesha256: 'SR2Mu/JOUfvCHkOakMdXJJNBekv7yYptwBEuR+BblTU=' },
               });
 
             headObjectStub

diff --git a/lib/plugins/aws/package/lib/core-cloudformation-template.json b/lib/plugins/aws/package/lib/core-cloudformation-template.json
@@ -40,6 +40,17 @@
                       "/*"
                     ]
                   ]
+                },
+                {
+                  "Fn::Join": [
+                    "",
+                    [
+                      "arn:",
+                      { "Ref": "AWS::Partition" },
+                      ":s3:::",
+                      { "Ref": "ServerlessDeploymentBucket" }
+                    ]
+                  ]
                 }
               ],
               "Condition": {

diff --git a/lib/plugins/aws/package/lib/generateCoreTemplate.test.js b/lib/plugins/aws/package/lib/generateCoreTemplate.test.js
@@ -42,6 +42,12 @@ describe('#generateCoreTemplate()', () => {
               ],
             ],
           },
+          {
+            'Fn::Join': [
+              '',
+              ['arn:', { Ref: 'AWS::Partition' }, ':s3:::', { Ref: 'ServerlessDeploymentBucket' }],
+            ],
+          },
         ],
         Condition: {
           Bool: { 'aws:SecureTransport': false },