Ccodemod

codemod/aws-cdk-s3-bucket-enforce-ssl

Adds enforceSSL: true property to AWS CDK S3 Bucket constructor calls to enforce encryption-in-transit

securityawscdks3sslencryptiontransformation
Public
0 executions
Use dashboard
Apply to Repository

Run locally

npx codemod @codemod/aws-cdk-s3-bucket-enforce-ssl

AWS CDK S3 Bucket Enforce SSL

npm version

This codemod automatically adds the enforceSSL: true property to AWS CDK S3 Bucket constructor calls to enforce encryption-in-transit. This addresses the security vulnerability CWE-319: Cleartext Transmission of Sensitive Information.

Why Use This Codemod?

AWS S3 buckets without SSL enforcement allow unencrypted HTTP connections, which poses a security risk for sensitive data transmission. This codemod helps you automatically secure your S3 buckets by ensuring all requests must use HTTPS/TLS encryption.

What It Does

The codemod transforms AWS CDK S3 Bucket constructor calls to include the enforceSSL: true property:

Before

typescript

After

typescript

Supported Import Patterns

This codemod works with various AWS CDK import patterns:

typescript

What It Won't Transform

The codemod safely skips:

  • Buckets that already have enforceSSL: true
  • Buckets with enforceSSL: false (intentionally disabled)
  • Non-S3 Bucket constructors (custom classes, other AWS services)
  • Files without AWS CDK S3 imports

Installation & Usage

Via Codemod CLI (Recommended)

bash

Via Package Manager

bash

Options

bash

File Extensions Supported

  • .ts (TypeScript)
  • .tsx (TypeScript with JSX)
  • .js (JavaScript)
  • .jsx (JavaScript with JSX)

Security Impact

This transformation helps address:

  • CWE-319: Cleartext Transmission of Sensitive Information
  • AWS Security Best Practices for S3 encryption in transit
  • Compliance requirements that mandate encrypted data transmission

Limitations & Caveats

  1. Manual Review Recommended: While this codemod is designed to be safe, review the changes before committing, especially for buckets used for public static websites where HTTPS enforcement might not be desired.

  2. CDK Version Compatibility: Works with both CDK v1 (@aws-cdk/*) and CDK v2 (aws-cdk-lib) import patterns.

  3. Complex Prop Objects: The codemod handles standard object literals but may not work correctly with computed property names or complex spread operations.

Development

Building from Source

bash

Running Tests

bash

Contributing

This codemod is part of the Arc Security Codemods collection. Contributions are welcome!

References

License

MIT

Ready to contribute?

Build your own codemod and share it with the community.

Publish a codemodJoin the community