🧾 JSONmedium
1. Deny non-TLS access to a bucket
Write an S3 bucket policy statement that DENIES all S3 access when the connection is NOT encrypted (HTTP instead of HTTPS): • Effect: "Deny" • Principal: "*" • Action: "s3:*" • Resource: "arn:aws:s3:::secure-bucket/*" • Condition: Bool "aws:SecureTransport" = "false"
How to approach this
Data must be encrypted IN TRANSIT. The `aws:SecureTransport` key is false for plain HTTP; a bucket policy that DENIES `s3:*` when it is `"false"` forces every request over TLS. This is the canonical "enforce HTTPS" bucket policy — a required control in regulated environments. Note the value "false" is a STRING in a Bool condition, and a bucket policy needs a Principal.
config.json