S3 bucket policy denies requests over insecure transport

Check ID: s3_bucket_secure_transport_policy
Provider: AWS
Service: s3
Severity: MEDIUM
Categories: encryption
Resource type: AwsS3Bucket

What this check verifies

Amazon S3 buckets are evaluated for a bucket policy that enforces secure transport by denying requests when aws:SecureTransport is false. Buckets without this explicit denial, or without a policy, are treated as allowing access over insecure transport.

Risk

HTTP access exposes object data and auth details to eavesdropping and man-in-the-middle attacks. Captured pre-signed URLs can be replayed to exfiltrate data. Traffic can be intercepted or altered, undermining confidentiality and integrity of S3 content.

Recommendation

Enforce HTTPS-only access with a bucket policy that denies requests when aws:SecureTransport=false. Prefer private access (VPC endpoints or CloudFront with TLS), avoid S3 website endpoints, apply least privilege, use short-lived HTTPS pre-signed URLs, and monitor logs for insecure access attempts.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws s3api put-bucket-policy --bucket <example_resource_name> --policy '{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Principal":"*","Action":"s3:*","Resource":"arn:aws:s3:::<example_resource_name>/*","Condition":{"Bool":{"aws:SecureTransport":"false"}}}]}'

# Deny non-SSL (HTTP) requests to the S3 bucket
resource "aws_s3_bucket_policy" "policy" {
  bucket = "<example_resource_name>"
  policy = jsonencode({
    Version   = "2012-10-17"
    Statement = [{
      Effect    = "Deny"
      Principal = "*"
      Action    = "s3:*"
      Resource  = "arn:aws:s3:::<example_resource_name>/*"
      Condition = {
        Bool = {
          "aws:SecureTransport" = "false" # Critical: deny requests not using SSL/TLS
        }
      }
    }]
  })
}

# CloudFormation: Deny non-SSL (HTTP) requests to the S3 bucket
Resources:
  BucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: <example_resource_name>
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Deny
            Principal: "*"
            Action: s3:*
            Resource: arn:aws:s3:::<example_resource_name>/*
            Condition:
              Bool:
                aws:SecureTransport: "false"  # Critical: deny requests not using SSL/TLS

In the AWS Console, go to S3 and open the bucket <example_resource_name>
Select the Permissions tab and click Edit in Bucket policy

Paste this policy, replacing the bucket name:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Principal": "*",
      "Action": "s3:*",
      "Resource": "arn:aws:s3:::<example_resource_name>/*",
      "Condition": { "Bool": { "aws:SecureTransport": "false" } }
    }
  ]
}

Click Save changes

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = s3_bucket_secure_transport_policy. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

S3 bucket ACL grants no public write access S3 bucket has server access logging enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires