data "aws_iam_policy_document" "this" {
  version = "2012-10-17"

  # Enforce encryption in transit
  statement {
    sid     = "AllowSSLRequestsOnly"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = sort([
      "${var.template_bucket_arn}/*",
      var.template_bucket_arn
    ])
    principals {
      type        = "AWS"
      identifiers = ["*"]
    }
    condition {
      test     = "Bool"
      values   = ["false"]
      variable = "aws:SecureTransport"
    }
  }
}