Ensure S3 Bucket Policy is set to deny HTTP requests

From Console

1. Login to AWS Management Console and open the Amazon S3 console using https://console.aws.amazon.com/s3/
2. Select the Check box next to the Bucket.
3. Click on Permissions.
4. Click Bucket Policy
5. Add this to the existing policy filling in the required information

{
   "Sid":"Deny Plain HTTP",
   "Effect":"Deny",
   "Principal":"*",
   "Action":"s3:GetObject",
   "Resource":"arn:aws:s3:::<bucket_name>/*",
   "Condition":{
      "Bool":{
         "aws:SecureTransport":"false"
      }
..

1. Choose Save
2. Repeat for all the buckets in your AWS account that contain sensitive data.

Using AWS Policy Generator

1. Repeat steps 1-4 above.
2. Click on Policy Generator at the bottom of the Bucket Policy Editor
3. Select Policy Type S3 Bucket Policy
4. Add Statements
   • Effect = Deny
   • Principal = *
   • AWS Service = Amazon S3
   • Actions = GetObject
   • Amazon Resource Name =
5. Generate Policy
6. Copy the text and add it to the Bucket Policy.

From Command Line

1. Export the bucket policy to a json file.

aws s3api get-bucket-policy --bucket <bucket_name> --query Policy --output text > policy.json

1. Modify the policy.json file by adding in this statement

{
            "Sid": "Deny Plain HTTP",
            "Effect": "Deny",
            "Principal": "*",
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::<bucket_name>/*",
            "Condition": {
                "Bool": {
                    "aws:SecureTransport": "false"
                }
            }
        }

1. Apply this modified policy back to the S3 bucket:

aws s3api put-bucket-policy --bucket <bucket_name> --policy file://policy.json

Service-wide remediation

Recommended when many resources are affected: fix the platform baseline first so new resources inherit the secure setting, then remediate the existing flagged resources in batches.

AWS

Use AWS Organizations guardrails, AWS Config rules or conformance packs where they fit, approved account baselines, and IaC modules so new resources inherit the secure setting.

Operational rollout

1. Fix the baseline first at the account, subscription, project, cluster, or tenant scope that owns this control.
2. Remediate the currently affected resources in batches, starting with internet-exposed and production assets.
3. Re-scan and track approved exceptions with an owner and expiry date.