cis-aws-foundations-3-1-1

name	cis-aws-foundations-3.1.1
description	Ensure S3 Bucket Policy is set to deny HTTP requests
category	cis-storage
version	7.0.0
author	cyberstrike-official
tags	["cis","aws","storage","s3","encryption","tls","https","bucket-policy"]
cis_id	3.1.1
cis_benchmark	CIS AWS Foundations Benchmark v7.0.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	["cis-aws-foundations-3.1.2","cis-aws-foundations-3.1.3","cis-aws-foundations-3.1.4"]
prerequisites	[]
severity_boost	{}

Ensure S3 Bucket Policy is set to deny HTTP requests

Description

At the Amazon S3 bucket level, permissions can be configured through a bucket policy to ensure objects are accessible only through HTTPS.

Rationale

By default, Amazon S3 allows both HTTP and HTTPS requests. To ensure that access to S3 objects is only permitted through HTTPS, you must explicitly deny HTTP requests. Bucket policies that allow HTTPS requests without explicitly denying HTTP requests do not meet this requirement.

Impact

If HTTP access is not explicitly denied, data transmitted to and from S3 buckets may be exposed to interception or man-in-the-middle attacks.

Audit Procedure

Using AWS Console

1. Login to the AWS Management Console and open the Amazon S3 console using https://console.aws.amazon.com/s3/
2. Select the target bucket
3. Select the 'Permissions' tab
4. Select Bucket policy
5. Ensure a policy exists that explicitly denies HTTP requests using one of the following conditions:

Option 1: Deny non-HTTPS requests

{
  "Sid": "<optional>",
  "Effect": "Deny",
  "Principal": "*",
  "Action": "s3:*",
  "Resource": "arn:aws:s3:::<bucket_name>/*",
  "Condition": {
    "Bool": {
      "aws:SecureTransport": "false"
    }
  }