SAA-C03 Practice Question 33: S3 Deny Insecure Transport
AWS Certified Solutions Architect – Associate (SAA-C03) · Test 4 · question 3 of 10
A compliance standard requires that objects in an S3 bucket can only be read or written over an encrypted connection. An auditor has found that some legacy clients still call the bucket over plain HTTP. The team needs those requests rejected by the bucket itself, regardless of which IAM principal makes them.
What should the solutions architect implement?
Show answer and explanation
Answer:
aws:SecureTransport is a global condition key that is true when the request arrives over TLS. An explicit Deny on the bucket policy conditioned on it being false rejects every plain-HTTP request at the bucket, and because it is a resource-based policy it applies to every principal including those in other accounts. An explicit deny also overrides any allow elsewhere, which is what makes this enforceable rather than advisory.
Option A protects data at rest, not in transit. SSE-S3 encrypts the stored object and says nothing about the protocol the request used.
Option B addresses retention and accidental deletion. Versioning and Object Lock preserve object history; neither inspects the connection.
Option C relies on editing every client role and controls the source network rather than the protocol. A request from inside the corporate network over plain HTTP would still be allowed, and any role missed by the rollout is unprotected.
Reference: Security best practices for Amazon S3