This codemod automatically adds the enforceSSL: true property to AWS CDK S3 Bucket constructor calls to enforce encryption-in-transit. This addresses the security vulnerability CWE-319: Cleartext Transmission of Sensitive Information.
Why Use This Codemod?
AWS S3 buckets without SSL enforcement allow unencrypted HTTP connections, which poses a security risk for sensitive data transmission. This codemod helps you automatically secure your S3 buckets by ensuring all requests must use HTTPS/TLS encryption.
What It Does
The codemod transforms AWS CDK S3 Bucket constructor calls to include the enforceSSL: true property:
Before
typescript
// No props object
new s3.Bucket(this, 'MyBucket')
// Empty props object
new s3.Bucket(this, 'MyBucket', {})
// Existing props without enforceSSL
new s3.Bucket(this, 'MyBucket', {
versioned: true,
encryption: s3.BucketEncryption.S3_MANAGED
})
// Direct Bucket import
new Bucket(this, 'MyBucket')
After
typescript
// Adds props object with enforceSSL
new s3.Bucket(this, 'MyBucket', {
enforceSSL: true
})
// Replaces empty props with enforceSSL
new s3.Bucket(this, 'MyBucket', {
enforceSSL: true
})
// Adds enforceSSL to existing props
new s3.Bucket(this, 'MyBucket', {
versioned: true,
encryption: s3.BucketEncryption.S3_MANAGED,
enforceSSL: true
})
// Works with direct imports too
new Bucket(this, 'MyBucket', {
enforceSSL: true
})
Supported Import Patterns
This codemod works with various AWS CDK import patterns:
typescript
// Named import of s3 namespace
import { s3 } from 'aws-cdk-lib';
new s3.Bucket(this, 'MyBucket');
// Direct Bucket import
import { Bucket } from 'aws-cdk-lib/aws-s3';
new Bucket(this, 'MyBucket');
// Namespace imports
import * as aws from 'aws-cdk-lib';
new aws.aws_s3.Bucket(this, 'MyBucket');
// Legacy CDK v1 imports
import { Bucket } from '@aws-cdk/aws-s3';
new Bucket(this, 'MyBucket');
What It Won't Transform
The codemod safely skips:
Buckets that already have enforceSSL: true
Buckets with enforceSSL: false (intentionally disabled)
Non-S3 Bucket constructors (custom classes, other AWS services)
Files without AWS CDK S3 imports
Installation & Usage
Via Codemod CLI (Recommended)
bash
npx codemod@latest aws-cdk-s3-bucket-enforce-ssl
Via Package Manager
bash
# Install globally
npm install -g @codemod/aws-cdk-s3-bucket-enforce-ssl
# Run on your codebase
npx @codemod/aws-cdk-s3-bucket-enforce-ssl /path/to/your/code
Options
bash
# Run on specific directory
npx codemod@latest aws-cdk-s3-bucket-enforce-ssl ./src
# Include additional file extensions
npx codemod@latest aws-cdk-s3-bucket-enforce-ssl --include="**/*.{ts,js,tsx,jsx}"
# Dry run to see what would change
npx codemod@latest aws-cdk-s3-bucket-enforce-ssl --dry-run
File Extensions Supported
.ts (TypeScript)
.tsx (TypeScript with JSX)
.js (JavaScript)
.jsx (JavaScript with JSX)
Security Impact
This transformation helps address:
CWE-319: Cleartext Transmission of Sensitive Information
AWS Security Best Practices for S3 encryption in transit
Compliance requirements that mandate encrypted data transmission
Limitations & Caveats
Manual Review Recommended: While this codemod is designed to be safe, review the changes before committing, especially for buckets used for public static websites where HTTPS enforcement might not be desired.
CDK Version Compatibility: Works with both CDK v1 (@aws-cdk/*) and CDK v2 (aws-cdk-lib) import patterns.
Complex Prop Objects: The codemod handles standard object literals but may not work correctly with computed property names or complex spread operations.
Development
Building from Source
bash
git clone [repository-url]
cd aws-cdk-s3-bucket-enforce-ssl
pnpm install
pnpm build
Running Tests
bash
pnpm test
Contributing
This codemod is part of the Arc Security Codemods collection. Contributions are welcome!
