Skip to main content

ENFORCE TLS-ONLY ACCESS WITH AN S3 BUCKET POLICY

This guide shows you how to attach a bucket policy that denies every request to a bucket made without TLS. The policy denies any request where aws:SecureTransport is false.

Prerequisites

  • An existing S3 bucket
  • AWS credentials in the default credential chain that can put and read bucket policies on that bucket

Pull the extension

swamp extension pull @swamp/aws/s3 --yes

The output looks like:

INF extension·pull: Pulling "@swamp/aws/s3"@"2026.10.13.1"
INF extension·pull: Identity verified: "@swamp/aws/s3"@"2026.10.13.1"
INF extension·pull: Pulled "@swamp/aws/s3"@"2026.10.13.1"
INF extension·pull: Extracted 24 files:

Define the policy

Create a behavior of type @swamp/aws/s3/bucket-policy named assets-tls-only. Create and Run a Behavior shows how. Set its global arguments, replacing example-swamp-assets with your bucket name in Bucket and in both Resource ARNs:

globalArguments:
  Bucket: example-swamp-assets
  region: us-east-1
  PolicyDocument:
    Version: "2012-10-17"
    Statement:
      - Sid: DenyInsecureTransport
        Effect: Deny
        Principal: "*"
        Action: "s3:*"
        Resource:
          - arn:aws:s3:::example-swamp-assets
          - arn:aws:s3:::example-swamp-assets/*
        Condition:
          Bool:
            aws:SecureTransport: "false"

Bucket and PolicyDocument are required. The two Resource entries cover the bucket and every object in it.

A bucket has only one policy. If the bucket already has a policy, add the DenyInsecureTransport statement to that policy's statements in PolicyDocument, so the existing permissions are kept.

Attach the policy

swamp behavior run assets-tls-only create

This attaches the policy document to the bucket in AWS and writes the S3 BucketPolicy resource state into the repository's data. After this, any request to the bucket that does not use TLS is denied.

Record the applied policy

swamp behavior run assets-tls-only sync

This reads the policy back from AWS and writes it to the S3 BucketPolicy resource state, including any changes made outside Swamp. The @jentz/aws-s3-bucket-audit report checks this state for its bucket-tls-only-policy rule.

To change the policy later, edit PolicyDocument and run the update method.