S3 general purpose buckets should require requests to use TLS

How to fix it

• Overwrites existing settings: The CLI and Terraform routes replace the whole bucket policy, so add this statement to the current policy rather than sending it alone.
• Can break clients: Clients still calling the bucket over plain HTTP, including a static website on the S3 website endpoint (HTTP only), are refused once this is saved, so move them to HTTPS first.

In the console

S3 → the bucket → Permissions → Bucket policy

Effect

Deny, in a statement with no NotPrincipal, NotAction or NotResource

Principal

"*" or {"AWS": "*"}; a statement naming principals or services does not count

Action

s3:*

Resource

arn:aws:s3:::<bucket-name> and arn:aws:s3:::<bucket-name>/*, in one statement or two

Condition

Bool aws:SecureTransport false as the only key; an s3:TlsVersion rule alone does not count

With the AWS CLI

aws s3api put-bucket-policy --bucket <bucket-name> --policy file://bucket-policy.json

With Terraform

resource "aws_s3_bucket_policy" "this" {
  bucket = var.bucket_name
  policy = data.aws_iam_policy_document.deny_insecure_transport.json
}