Merge branch 'bugfix/ARSN-387-ssl-check-fix' into tmp/octopus/w/7.70/bugfix/ARSN-387-ssl-check-fix

lib/policyEvaluator/utils/conditions.ts

@@ -61,7 +61,7 @@ export function findConditionKey(
     case 'aws:referer': return headers.referer;
     // aws:SecureTransport – Used to check whether the request was sent
     // using SSL (see Boolean Condition Operators).
-    case 'aws:SecureTransport': return requestContext.getSslEnabled() ? 'true' : 'false';
+    case 'aws:SecureTransport': return headers?.['x-forwarded-proto'] === 'https' ? 'true' : 'false';
     // aws:SourceArn – Used check the source of the request,
     // using the ARN of the source. N/A here.
     case 'aws:SourceArn': return undefined;

lib/policyEvaluator/utils/variables.ts

@@ -38,7 +38,7 @@ function findVariable(variable: string, requestContext: RequestContext): string
     // aws:SecureTransport is boolean value that represents whether the
     // request was sent using SSL
     map.set('aws:SecureTransport',
-        requestContext.getSslEnabled() ? 'true' : 'false');
+        headers?.['x-forwarded-proto'] === 'https' ? 'true' : 'false');
     // aws:SourceIp is requester's IP address, for use with IP address
     // conditions
     map.set('aws:SourceIp', requestContext.getRequesterIp());

tests/unit/policyEvaluator.spec.js

@@ -906,7 +906,9 @@ describe('policyEvaluator', () => {
             () => {
                 policy.Statement.Condition = { Bool:
                         { 'aws:SecureTransport': 'true' } };
-                const rcModifiers = { _sslEnabled: false };
+                const rcModifiers = { _headers: {
+                    'x-forwarded-proto': 'http',
+                } };
                 check(requestContext, rcModifiers, policy, 'Neutral');
             });
 
@@ -915,7 +917,9 @@ describe('policyEvaluator', () => {
             () => {
                 policy.Statement.Condition = { Bool:
                         { 'aws:SecureTransport': 'true' } };
-                const rcModifiers = { _sslEnabled: true };
+                const rcModifiers = { _headers: {
+                    'x-forwarded-proto': 'https',
+                } };
                 check(requestContext, rcModifiers, policy, 'Allow');
             });