S3 buckets whose policy does not deny plain HTTP requests

Why S3 needs to be told to refuse HTTP

The S3 service endpoints are listed as accepting both HTTP and HTTPS. A custom client, an old library or a misconfigured tool can therefore send requests, with their headers and the object data itself, over an unencrypted connection. Nothing in S3 stops that unless the bucket policy does.

The S3 security best practices recommend allowing only encrypted connections by using the aws:SecureTransport condition in the bucket policy, and setting CloudWatch alarms that alert on HTTP access attempts.

Reading the bucket policy

aws s3api get-bucket-policy --bucket my-bucket --query Policy --output text

Look for a statement with "Effect": "Deny" and a condition of "Bool": {"aws:SecureTransport": "false"}. If the bucket has no policy at all, there is nothing to deny HTTP, and the bucket accepts it.

Evidence ZopNight needs before it flags

During discovery ZopNight reads each bucket’s policy and records whether a Deny on aws:SecureTransport being false is present. The rule fires only when that record exists and says the deny is missing.

Why some buckets are skipped

If the policy could not be read, because of throttling or an access-denied response, ZopNight records nothing and raises no finding. A missing answer is never treated as a missing deny. Tags do not affect the result.

Exposure, not spend

The finding saves nothing. It closes the path by which data or request signatures could travel in clear text over a network you do not control.

Adding an HTTPS-only statement

1. Check access logs or CloudTrail for any client still using HTTP and move it to HTTPS.
2. Add a Deny statement to the existing policy rather than replacing it. The statement to merge in:

{
  "Sid": "DenyInsecureTransport",
  "Effect": "Deny",
  "Principal": "*",
  "Action": "s3:*",
  "Resource": ["arn:aws:s3:::my-bucket", "arn:aws:s3:::my-bucket/*"],
  "Condition": {"Bool": {"aws:SecureTransport": "false"}}
}

3. Apply the merged document with aws s3api put-bucket-policy --bucket my-bucket --policy file://policy.json.
4. Test a read and a write from each application.