CLF-C02 Practice Question 125: Enforce HTTPS Access
AWS Certified Cloud Practitioner (CLF-C02) · Test 13 · question 5 of 10
A compliance rule states that an Amazon S3 bucket holding customer statements must reject every request that is not sent over an encrypted HTTPS (TLS) connection, including requests from users and applications that otherwise have permission to access the bucket. How should the company enforce this?
Show answer and explanation
Answer:
To enforce encryption of data in transit, AWS recommends allowing only encrypted connections over HTTPS (TLS) by using the `aws:SecureTransport` condition in S3 bucket policies. A statement that denies access when aws:SecureTransport is false rejects any plain-HTTP request. Because an explicit deny overrides any allow, the rule applies even to principals whose IAM policies grant access to the bucket. The AWS Config managed rule s3-bucket-ssl-requests-only can then detect buckets that aren't enforcing this.
Option A protects data at rest. Objects are encrypted on disk no matter how they were uploaded, but SSE-S3 doesn't stop anyone from sending requests over unencrypted HTTP. Option C prevents public access through policies and ACLs, but authorized users could still connect without TLS. Option D protects against accidental or unauthorized *deletion* of object versions. It has no effect on the protocol used to reach the bucket.
Reference: Security best practices for Amazon S3