# 2.1.1 Ensure S3 Bucket Policy is set to deny HTTP requests

- Source: https://support.icompaas.com/support/solutions/articles/62000233098-2-1-1-ensure-s3-bucket-policy-is-set-to-deny-http-requests
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS CIS V.4 Level 1 Benchmarks](https://support.icompaas.com/support/solutions/62000112671) › [CIS Control 2](https://support.icompaas.com/support/solutions/folders/62000169193)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

### Profile Applicability:

Level 2

## Description:

By default, Amazon S3 allows both HTTP and HTTPS requests for accessing objects.

-   This control ensures that only HTTPS requests are allowed by explicitly denying HTTP access.
    
-   S3 bucket policies should include a rule to reject requests using HTTP to enforce encrypted communication.
    

## Rationale:

-   HTTP requests send data in plaintext, exposing sensitive information to interception.
    
-   Man-in-the-Middle (MitM) attacks are easier when unencrypted HTTP connections are allowed.
    
-   Enforcing HTTPS ensures secure data transfer between clients and Amazon S3.
    

## Impact:

-   If HTTP requests are denied, applications that rely on HTTP may fail.
    
-   Older clients that do not support HTTPS may need to be upgraded.
    
-   Bucket policy misconfigurations may prevent legitimate access.
    

## Default Value:

By default:

-   Amazon S3 accepts both HTTP and HTTPS requests.
    
-   HTTPS is not enforced unless an explicit policy denies HTTP access.
    

## Pre-Requisites:

1.  IAM permissions to modify bucket policies
    
    -   s3:PutBucketPolicy, s3:GetBucketPolicy
        
2.  AWS CLI installed (for automation)
    
3.  Identify all S3 buckets in your AWS account
    
4.  Ensure no application dependencies require HTTP access
    

## Remediation:

### Test Plan:

## Using AWS Console

1.  Login to AWS Console → Open S3 Console.
    
2.  Click on Buckets and select the target bucket.
    

                ![](https://support.icompaas.com/assets/kb/d2bb85bc7ac069b7.png)

3.  Click on Permissions → Bucket Policy.
    

                ![](https://support.icompaas.com/assets/kb/1dbfd39216667a36.png)

-   Verify if the policy explicitly denies HTTP requests by checking for:

 {
    "Effect": "Deny",
    "Principal": "\*",
    "Action": "s3:\*",
    "Resource": "arn:aws:s3:::<bucket\_name>/\*",
    "Condition": {
        "Bool": {
            "aws:SecureTransport": "false"
        }
    }
}

4.  If this rule does not exist, HTTP requests are allowed.
    

## Using AWS CLI

Step 1: List All S3 Buckets

aws s3 ls

-   Returns a list of all buckets in the AWS account.
    

Step 2: Check the Policy for Each Bucket

aws s3api get-bucket-policy --bucket <bucket\_name> | grep aws:SecureTransport

OR

aws s3api get-bucket-policy --bucket <bucket\_name> | grep s3:TlsVersion

-   If an error appears, it means the bucket has no policy and allows both HTTP and HTTPS requests.
    
-   If aws:SecureTransport is not set to false, HTTP access is still allowed.
    

## Implementation Steps:

## Using AWS Console

1.  Login to AWS Console → Open S3 Console.
    
2.  Click on Buckets and select the target bucket.
    

             ![](https://support.icompaas.com/assets/kb/504fd59d96d37ed8.png)

3.  Click on Permissions → Bucket Policy.
    

           ![](https://support.icompaas.com/assets/kb/5a6b46eb8ab1238f.png)

  

              ![](https://support.icompaas.com/assets/kb/a5cf73f95790131c.png)

-   Add the following JSON policy:
    
     {
        "Effect": "Deny",
        "Principal": "\*",
        "Action": "s3:\*",
        "Resource": "arn:aws:s3:::<bucket\_name>/\*",
        "Condition": {
            "Bool": {
                "aws:SecureTransport": "false"
            }
        }
    }
    

4.  Click Save.
    

             ![](https://support.icompaas.com/assets/kb/4ed55a69b21e22bb.png)

## Use AWS Policy Generator (GUI Alternative)

1.  Login to AWS Console → Open S3 Console.
    
2.  Select Bucket → Click Permissions → Bucket Policy.
    

                   ![](https://support.icompaas.com/assets/kb/fd34f0bb1da88ce5.png)

                  ![](https://support.icompaas.com/assets/kb/e5a2d5294270e20e.png)

                   ![](https://support.icompaas.com/assets/kb/301def6cd578e626.png)

3.  Click Policy Generator at the bottom
    

                 ![](https://support.icompaas.com/assets/kb/07bb669d95c02f5f.png)

4.  Enter policy details:
    
    -   Effect = Deny
        
    -   Principal = \*
        
    -   AWS Service = Amazon S3
        
    -   Actions = s3:\*
        
    -   Amazon Resource Name (ARN) = arn:aws:s3:::<bucket\_name>
        
    -   Condition = "aws:SecureTransport": "false"
        
5.  Click Generate Policy → Copy Generated Policy into the Bucket Policy Editor.
    
6.  Click Save.
    

## Using AWS CLI

Step 1: Export the Current Policy to a JSON File

aws s3api get-bucket-policy --bucket <bucket\_name> --query Policy --output text > policy.json

Step 2: Edit the policy.json file and add the following rule:

{
    "Effect": "Deny",
    "Principal": "\*",
    "Action": "s3:\*",
    "Resource": "arn:aws:s3:::<bucket\_name>/\*",
    "Condition": {
        "Bool": {
            "aws:SecureTransport": "false"
        }
    }
}

Step 3: Apply the Updated Policy

aws s3api put-bucket-policy --bucket <bucket\_name> --policy file://policy.json

##   

## Backout Plan:

If applications require HTTP access, follow these steps:

Modify the bucket policy to allow HTTP requests:

 {
    "Effect": "Allow",
    "Principal": "\*",
    "Action": "s3:\*",
    "Resource": "arn:aws:s3:::<bucket\_name>/\*"
}

Use AWS CLI to remove the deny rule:

 aws s3api delete-bucket-policy --bucket <bucket\_name>

1.  Test to ensure HTTP access is restored.
    

## References:

-    [AWS Docs](https://aws.amazon.com/premiumsupport/knowledge-center/s3-bucket-policy-for-config-rule/)
    
-   [AWS Best Practices](https://aws.amazon.com/blogs/security/how-to-use-bucket-policies-and-apply-defense-in-depth-to-help-secure-your-amazon-s3-data/)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.