Force SSL on Amazon S3

amazon-s3, amazon-web-services, https, ssl

Solution

I believe this can be achieved using a bucket policy. Deny all HTTP requests to the bucket in question using the condition `aws:SecureTransport: false`. The following is not tested but it should give you an idea of how to set it up for your case.

{
    "Statement":[
        {
            "Action": "s3:*",
            "Effect":"Deny",
            "Principal": "*",
            "Resource":"arn:aws:s3:::bucketname/*",
            "Condition":{
                "Bool":
                { "aws:SecureTransport": false }
            }
        }
    ]
}

Problem

Is it possible (via IAM, bucket policy, or otherwise) to force Amazon S3 to only serve content over HTTPS/SSL and deny all regular, unencrypted HTTP access?

Original source