S3 Bucket Policy Project 5: HTTPS Enforce (aws:SecureTransport)

By Ravindra Bagale, trainer · LinkedIn · Last updated: 28 October 2026

1. Story

Dr. Anil Krishnan (चेन्नई) व Jonas Becker (Frankfurt). Auditor: HTTP अजून शक्य आहे का?

2. SecureTransport का?

हे का लागतं?

HTTP = wire leak. SecureTransport false → Deny.

• एक Deny
• सगळे principals
• TLS version वेगळं
• curl http test

3. Policy

हे काय आहे?

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyInsecureTransport",
      "Effect": "Deny",
      "Principal": "*",
      "Action": "s3:*",
      "Resource": [
        "arn:aws:s3:::rb-secure-uploads-ap-south-1",
        "arn:aws:s3:::rb-secure-uploads-ap-south-1/*"
      ],
      "Condition": {
        "Bool": { "aws:SecureTransport": "false" }
      }
    }
  ]
}

Line-by-line

1. Clear Sid.
2. Deny.
3. *.
4. s3:*.
5. Both ARNs.
6. Non-TLS only.

4. CLI

कसं करायचं (step by step)

aws s3api put-bucket-policy --bucket rb-secure-uploads-ap-south-1 --policy file://https-only.json
# (empty success)

echo secret > t.txt
aws s3 cp t.txt s3://rb-secure-uploads-ap-south-1/t.txt
# upload success over HTTPS CLI

5. Allow/deny

# ALLOW — HTTPS
curl -s -o /dev/null -w "%{http_code}\n" -I \
  https://rb-secure-uploads-ap-south-1.s3.ap-south-1.amazonaws.com/t.txt
# 403 without public read is OK for private buckets; use signed HTTPS CLI for content:
aws s3 cp s3://rb-secure-uploads-ap-south-1/t.txt -   # works (HTTPS)

# DENY — force HTTP (note: may redirect; use --http1.1 and endpoint that speaks HTTP)
aws s3 cp s3://rb-secure-uploads-ap-south-1/t.txt /tmp/x --no-sign-request --endpoint-url http://s3.ap-south-1.amazonaws.com
# AccessDenied when policy sees SecureTransport=false

6. TLS version

SecureTransport = TLS होते का. TLS 1.2+ pin = CF/ALB policies — फक्त bool नाही.

7. Multi-industry

Healthcare, SaaS, fintech, edtech.

8. AccessDenied debugging आणि Policy Simulator

AccessDenied क्रम: BPA → bucket Deny → IAM Allow → KMS → VPCe → ACL. Simulator BPA/VPC/KMS miss करू शकतो — खऱ्या CLI ने test.

# Decode
aws s3api get-bucket-policy --bucket BUCKET --query Policy --output text | python3 -m json.tool
aws s3api get-public-access-block --bucket BUCKET
aws iam simulate-principal-policy --policy-source-arn ARN \
  --action-names s3:GetObject --resource-arns arn:aws:s3:::BUCKET/key.txt
aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=GetObject --max-items 5

9. Lab: HTTPS-only

Org block नसेल तर ap-south-1 (Mumbai). आधी budget alert.

कसं करायचं (step by step)

1. Policy on.
2. HTTPS allow.
3. HTTP deny.
4. Evidence.

Cleanup (billing थांबवा)

1. Cleanup.
2. Empty bucket.

10. सामान्य errors आणि fixes

प्रत्येक row = खरी चूक. Panic करण्याआधी fix वाचा.

11. Troubleshooting checklist

1. Region + endpoint.
2. Policy + BPA.
3. Lab user.
4. Sid binary search.
5. CloudTrail.
6. KMS test.
7. VPCe path.
8. Lock cleanup.

12. FAQ

13. Interview Q&A

14. Tips — English, मराठी आणि हिंदी

15. Policy save करण्याआधी checklist

1. Business rule एका वाक्यात.
2. Allow vs Deny-unless; Deny wins.
3. ARN shapes.
4. Condition keys.
5. BPA first.
6. Allow+deny plan.
7. Cleanup plan.
8. json.tool.

16. Policy Simulator walkthrough

Simulator identity/resource typos साठी चांगला; BPA/VPCe/KMS miss होऊ शकतात. नंतर खऱ्या path वरून CLI.

1. Simulator → user/role.
2. Action + ARN.
3. Include bucket policy.
4. CLI confirm.
5. Mismatch → layers.

17. Copy-paste runbook

# 0) Region + names
export AWS_REGION=ap-south-1
export BUCKET=rb-lab-$(date +%s)-ap-south-1

# 1) Create + show BPA
aws s3api create-bucket --bucket $BUCKET --region $AWS_REGION \
  --create-bucket-configuration LocationConstraint=$AWS_REGION
aws s3api get-public-access-block --bucket $BUCKET || true

# 2) Validate + apply policy
python3 -m json.tool policy.json >/dev/null
aws s3api put-bucket-policy --bucket $BUCKET --policy file://policy.json
aws s3api get-bucket-policy --bucket $BUCKET --query Policy --output text | python3 -m json.tool | head

# 3) Allow test + Deny test (fill per project)
# ... project-specific curls / aws s3 cp ...

# 4) Cleanup
aws s3 rm s3://$BUCKET --recursive || true
aws s3api delete-bucket-policy --bucket $BUCKET || true
aws s3api delete-bucket --bucket $BUCKET

18. Industry story bank

वरील प्रत्येक project एक industry story वापरतो. इतर industries मध्ये फक्त bucket/principal/Condition बदला.

• Healthcare: SSE-KMS + OrgID + MFA.
• Fintech: IP + HTTPS + OAC.
• EdTech: OAC only.
• Logistics: VPCe.
• Media: Object Lock.
• Retail: prefix public read.
• SaaS: prefix homes.
• Gov: OrgID + MFA + Lock.

19. AccessDenied debugging flowchart

1. Error code + request id.
2. Bucket + region.
3. BPA.
4. Explicit Deny.
5. Conditions.
6. KMS key policy.
7. OAC id.
8. VPCe path.
9. Simulator + CLI.
10. Support last.

20. PR review checklist

• Valid JSON.
• Required fields.
• No open write.
• Tests.
• Cleanup.

उजळणी, मुलाखत आणि तुलना cards

हा lesson काही मिनिटांत revise करा. Cards phone वर save करा किंवा PNG download करा. प्रत्येक card वरचा QR हा lesson उघडतो.

अजून cards: Ravi Sir's Cards.