Customer data in an S3 bucket must be accessed only over encrypted transport.
Reject accidental HTTP requests.
Which condition is most appropriate?
Use an S3 bucket policy with an explicit deny when the aws:SecureTransport condition is false.
Detailed explanation
The condition identifies requests that are not using TLS and can be enforced with an explicit deny.
The condition identifies requests that are not using TLS and can be enforced with an explicit deny.
Lifecycle manages object transitions and does not encrypt network traffic.
Lifecycle manages object transitions and does not encrypt network traffic.
DNS records do not enforce TLS on S3 API requests.
DNS records do not enforce TLS on S3 API requests.
The policy Version field identifies policy syntax and does not control transport encryption.
The policy Version field identifies policy syntax and does not control transport encryption.
Check official documentation
Compare the following points with the official documentation.
Amazon S3 bucket policyのSecureTransport公式例を確認する。
What to confirm
リソースポリシーで転送中暗号化を強制できる。
Key points
- aws:SecureTransport
- S3 bucket policy
- TLS
Notes
- Environment: AWS公式S3ドキュメントの確認
- Confirm current AWS service behavior in the official documentation.
Foundation review
Explicit deny
A deny for insecure transport applies even when another policy would otherwise allow the request.
Policy syntax versus transport
The policy version field describes JSON policy language, not the network protocol.