S3 bucket policy should deny non-TLS (HTTP) access

What it checks

S3 bucket policy does not reference aws:SecureTransport — traffic can potentially be accepted over plain HTTP.

Where it applies

Terraform: aws_s3_bucket_policy, aws_s3_bucket

CloudFormation: AWS::S3::Bucket, AWS::S3::BucketPolicy

How to fix it

1. Attach an aws_s3_bucket_policy with an explicit Deny statement when aws:SecureTransport is false

Frameworks

• AWS FSBP S3.5
• SOC 2 CC6.7
• SOC 2 CC6.1
• HIPAA 164.312(a)(2)(iv)
• HIPAA 164.312(e)(1)

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules