---
title: S3 bucket policy should deny HTTP requests
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > S3 bucket policy should deny HTTP
  requests
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# S3 bucket policy should deny HTTP requests
 
## Description{% #description %}

AWS S3 buckets should have a bucket policy that explicitly denies HTTP requests. By default, Amazon S3 accepts both HTTP and HTTPS requests, and a bucket with no policy (or a policy that only allows HTTPS) leaves data in transit exposed to interception or man-in-the-middle attacks. A bucket passes when its policy contains a `Deny` statement that:

- Applies to all principals (`*`)
- Covers all S3 actions (`s3:*` or `*`)
- Covers all objects in this bucket (for example, `arn:aws:s3:::<bucket>/*` or `arn:aws:s3:::*/*`, in the bucket's AWS partition)
- Has the condition `"Bool": {"aws:SecureTransport": "false"}` and no other condition

A `Deny` on only the bucket ARN, an object prefix, or another bucket, or one narrowed by another condition such as `aws:SourceVpce`, does not count. This is an intentional deviation from CIS 7.1.0, which also accepts a `Deny` that enforces a minimum TLS version (`"NumericLessThan": {"s3:TlsVersion": "1.2"}`): this rule does not count that statement on its own, because HTTP requests carry no `s3:TlsVersion` key, so it never denies plain HTTP. To also enforce a minimum TLS version, add that statement alongside the `aws:SecureTransport` `Deny`, as shown in [Requiring a minimum TLS version](https://docs.aws.amazon.com/AmazonS3/latest/userguide/amazon-s3-policy-keys.html#example-object-tls-version).

## Remediation{% #remediation %}

Edit the bucket policy, as described in [Adding a bucket policy using the Amazon S3 console](https://docs.aws.amazon.com/AmazonS3/latest/userguide/add-bucket-policy.html), to add the HTTP-deny statement shown in [Managing access based on HTTP or HTTPS requests](https://docs.aws.amazon.com/AmazonS3/latest/userguide/example-bucket-policies.html#example-bucket-policies-HTTP-HTTPS).

## References{% #references %}

- [Adding a bucket policy using the Amazon S3 console](https://docs.aws.amazon.com/AmazonS3/latest/userguide/add-bucket-policy.html)
- [Security best practices for Amazon S3](https://docs.aws.amazon.com/AmazonS3/latest/userguide/security-best-practices.html)
- [IAM JSON policy elements: Condition operators](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html)
- [Managing access based on HTTP or HTTPS requests](https://docs.aws.amazon.com/AmazonS3/latest/userguide/example-bucket-policies.html#example-bucket-policies-HTTP-HTTPS)
- [Requiring a minimum TLS version](https://docs.aws.amazon.com/AmazonS3/latest/userguide/amazon-s3-policy-keys.html#example-object-tls-version)
- [CIS Amazon Web Services Benchmarks](https://www.cisecurity.org/benchmark/amazon_web_services)