Question

A CloudOps engineer is reviewing a compliance requirement stating that all data uploaded to an S3 bucket must be transmitted over encrypted connections. During an audit, it was discovered that some clients are still able to make plaintext HTTP requests to the bucket. The engineer must enforce that only encrypted connections are allowed, without modifying any client applications. What is the MOST effective way to meet this requirement?

Accepted Answer

Add a bucket policy that denies all S3 actions when the condition aws:SecureTransport is false

Answer

Enable default server-side encryption with SSE-S3 on the bucket

Answer

Attach an ACM certificate to the S3 bucket to force HTTPS connections

Answer

Enable S3 Block Public Access and turn on access logging for the bucket