Check provider logo

S3 bucket policy denies requests over insecure transport

s3_bucket_secure_transport_policy

Severitymedium
Services3
by Prowler
encryption

Amazon S3 buckets are evaluated for a bucket policy that enforces secure transport by denying requests when aws:SecureTransport is false.

Buckets without this explicit denial, or without a policy, are treated as allowing access over insecure transport.

Risk

HTTP access exposes object data and auth details to eavesdropping and man-in-the-middle attacks. Captured pre-signed URLs can be replayed to exfiltrate data. Traffic can be intercepted or altered, undermining confidentiality and integrity of S3 content.

Run this check with Prowler CLI

prowler aws --checks s3_bucket_secure_transport_policy

Run in Prowler Cloud

Recommendation

Enforce HTTPS-only access with a bucket policy that denies requests when aws:SecureTransport=false.

Prefer private access (VPC endpoints or CloudFront with TLS), avoid S3 website endpoints, apply least privilege, use short-lived HTTPS pre-signed URLs, and monitor logs for insecure access attempts.

Remediation

CLI

aws s3api put-bucket-policy --bucket <example_resource_name> --policy '{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Principal":"","Action":"s3:","Resource":"arn:aws:s3:::<example_resource_name>/*","Condition":{"Bool":{"aws:SecureTransport":"false"}}}]}'

Native IaC
Terraform
Other
  1. In the AWS Console, go to S3 and open the bucket <example_resource_name>
  2. Select the Permissions tab and click Edit in Bucket policy
  3. Paste this policy, replacing the bucket name: 
    {
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Principal": "*",
      "Action": "s3:*",
      "Resource": "arn:aws:s3:::<example_resource_name>/*",
      "Condition": { "Bool": { "aws:SecureTransport": "false" } }
    }
  ]
}
  4. Click Save changes

Source Code

Resource Type

AwsS3Bucket

References