HIGH

Ensure S3 bucket enforces SSL/TLS for all requests

Bucket policies should include a condition to deny requests that don't use HTTPS, ensuring all data in transit is encrypted.

Security Impact

HTTP requests transmit data in plaintext and can be intercepted by network-based attackers (man-in-the-middle).

How to Remediate

Add a bucket policy statement with Condition: {Bool: {aws:SecureTransport: false}} and Effect: Deny to enforce HTTPS.

Affected Resources

AWS::S3::BucketPolicy

Compliance Frameworks

SOC 2PCI-DSSHIPAAGDPR

How TigerGate Helps

TigerGate continuously monitors your AWS environment to detect and alert on this misconfiguration. Here's what our platform does for this specific check:

  • Continuous Scanning

    Automatically scans all Simple Storage Service (S3) resources across your AWS accounts every hour

  • Instant Alerts

    Get notified via Slack, email, or webhooks when this misconfiguration is detected

  • One-Click Remediation

    Fix this issue directly from the TigerGate dashboard with our guided remediation

  • Compliance Evidence

    Automatically collect audit evidence for SOC 2, PCI-DSS, HIPAA compliance

  • Drift Detection

    Get alerted if this configuration drifts back to an insecure state after remediation

Check Details

Check ID
aws-s3-10
Service
Simple Storage Service (S3)
Category
Encryption
Severity
HIGH

Automate This Check

TigerGate automatically scans your AWS environment for this and 575+ other security checks.

Start Free Trial

Related Simple Storage Service (S3) Checks

View all checks
aws-s3-1critical

Ensure S3 bucket has block public access enabled

aws-s3-2critical

Ensure S3 bucket policy does not allow public read access

aws-s3-3critical

Ensure S3 bucket policy does not allow public write access

aws-s3-4medium

Ensure MFA Delete is enabled on S3 buckets

aws-s3-5high

Ensure S3 bucket has server-side encryption enabled