Check provider logo

Secure transfer required is enabled for OSS buckets

oss_bucket_secure_transport_enabled

Severityhigh
Serviceoss
by Prowler
encryption

Alibaba Cloud OSS buckets should enforce secure transfer by requiring all requests to use HTTPS. A bucket policy that denies requests with acs:SecureTransport set to false ensures that data in transit is encrypted, rejecting any unencrypted HTTP connections to the storage endpoint.

Risk

Without secure transfer enforcement, OSS buckets accept HTTP requests that transmit data in plaintext. This exposes stored data to potential interception, man-in-the-middle attacks, and eavesdropping, compromising data confidentiality and integrity during transit.

Run this check with Prowler CLI

prowler alibabacloud --checks oss_bucket_secure_transport_enabled

Run in Prowler Cloud

Recommendation

Enforce secure transfer on OSS buckets by applying a bucket policy that denies all requests not using HTTPS, ensuring data in transit is always encrypted.

Remediation

CLI

aliyun oss PutBucketPolicy --bucket <bucket-name> --policy '{"Version":"1","Statement":[{"Effect":"Deny","Principal":[""],"Action":["oss:"],"Resource":["acs:oss:::<bucket-name>","acs:oss:::<bucket-name>/*"],"Condition":{"Bool":{"acs:SecureTransport":"false"}}}]}'

Terraform
Other
  1. Log on to the OSS Console
  2. In the bucket-list pane, click on a target OSS bucket
  3. Click on Files in the top middle of the console
  4. Click on Authorize
  5. Configure: Whole Bucket, *, None (Authorized Operation) and http (Conditions: Access Method) to deny HTTP access
  6. Click Save

Source Code

Resource Type

ALIYUN::OSS::Bucket

References