Ensure S3 Bucket Policy is set to deny HTTP requests

From Console

1. Login to AWS Management Console and open the Amazon S3 console using https://console.aws.amazon.com/s3/
2. Select the Check box next to the Bucket.
3. Click on Permissions.
4. Click Bucket Policy
5. Add this to the existing policy filling in the required information

{
   "Sid":"Deny Plain HTTP",
   "Effect":"Deny",
   "Principal":"*",
   "Action":"s3:GetObject",
   "Resource":"arn:aws:s3:::<bucket_name>/*",
   "Condition":{
      "Bool":{
         "aws:SecureTransport":"false"
      }
..

1. Choose Save
2. Repeat for all the buckets in your AWS account that contain sensitive data.

Using AWS Policy Generator

1. Repeat steps 1-4 above.
2. Click on Policy Generator at the bottom of the Bucket Policy Editor
3. Select Policy Type S3 Bucket Policy
4. Add Statements
   • Effect = Deny
   • Principal = *
   • AWS Service = Amazon S3
   • Actions = GetObject
   • Amazon Resource Name =
5. Generate Policy
6. Copy the text and add it to the Bucket Policy.

From Command Line

1. Export the bucket policy to a json file.

aws s3api get-bucket-policy --bucket <bucket_name> --query Policy --output text > policy.json

1. Modify the policy.json file by adding in this statement

{
            "Sid": "Deny Plain HTTP",
            "Effect": "Deny",
            "Principal": "*",
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::<bucket_name>/*",
            "Condition": {
                "Bool": {
                    "aws:SecureTransport": "false"
                }
            }
        }

1. Apply this modified policy back to the S3 bucket:

aws s3api put-bucket-policy --bucket <bucket_name> --policy file://policy.json

Multiple Remediation Paths

AWS

SERVICE-WIDE (RECOMMENDED when many resources are affected): Deploy centralized guardrails and remediation using AWS Config Conformance Packs and (if applicable) AWS Organizations SCPs.

aws configservice put-organization-conformance-pack --organization-conformance-pack-name <pack-name> --template-s3-uri s3://<bucket>/<template>.yaml

ASSET-LEVEL: Apply the resource-specific remediation steps above to only the affected assets.

PREVENTIVE: Add CI/CD policy checks (CloudFormation/Terraform validation) before deployment to prevent recurrence.

References for Service-Wide Patterns

• AWS Config Conformance Packs: https://docs.aws.amazon.com/config/latest/developerguide/conformance-packs.html
• AWS Organizations SCP examples: https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps_examples.html

Operational Rollout Workflow

Use this sequence to reduce risk and avoid repeated drift.

1. Contain at Service-Wide Scope First (Recommended)

• AWS: deploy/adjust organization conformance packs and policy guardrails.

aws configservice put-organization-conformance-pack --organization-conformance-pack-name <pack-name> --template-s3-uri s3://<bucket>/<template>.yaml

2. Remediate Existing Affected Assets

• Execute the control-specific Console/CLI steps documented above for each flagged resource.
• Prioritize internet-exposed and production assets first.

3. Validate and Prevent Recurrence

• Re-scan after each remediation batch.
• Track exceptions with owner and expiry date.
• Add preventive checks in IaC/CI pipelines.