S3 bucket does not require SSL/HTTPS for all requests

Severity: Medium
Service: S3
Check ID: S3_SSL_NOT_REQUIRED

What this check finds

Without a bucket policy that denies non-HTTPS requests, data transmitted to and from S3 can travel in cleartext, exposing it to network interception. CIS v5.0 §2.1.1 requires all S3 requests to use SSL.

Passing looks like: S3 requires SSL/HTTPS for all requests.

How to fix it

Add a bucket policy that denies any request where aws:SecureTransport is false.

AWS CLI

aws s3api put-bucket-policy --bucket BUCKET_NAME --policy '{"Statement":[{"Effect":"Deny","Principal":"*","Action":"s3:*","Resource":["arn:aws:s3:::BUCKET_NAME","arn:aws:s3:::BUCKET_NAME/*"],"Condition":{"Bool":{"aws:SecureTransport":"false"}}}]}'

Names in capitals are placeholders for your own resource. Review a command before you run it.

AWS console

S3→ Bucket → Permissions → Bucket policy → Edit.

Compliance controls it is evidence for

A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works

Compliance controls mapped to S3 bucket does not require SSL/HTTPS for all requests
Framework	Controls
CIS AWS Foundations Benchmark v5.0.0	2.1.1 Ensure S3 Bucket Policy is set to deny HTTP requests
PCI-DSS v4.0.1	2.2.7 All non-console administrative access is encrypted using strong cryptography 4.2 PAN is protected with strong cryptography during transmission over open, public networks
HIPAA Security Rule	164.312(e)(1) Implement technical security measures to guard against unauthorized access to ePHI in transit
SOC 2 — Trust Services Criteria	CC6.7 Encryption and Secret Management C1.1 Encryption of Confidential Data
NIST SP 800-53 Rev5 (Moderate)	SC-8 Transmission Confidentiality and Integrity SC-23 Session Authenticity
NIST Cybersecurity Framework 2.0	PR.DS-02 Data-in-transit is protected
ISO/IEC 27001:2022 Annex A	A.8.24 Use of cryptography

Checked on every scan

KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs

More S3 checks

All S3 checks