Policy Packs

Use a calculated policy to recognize effective encryption-in-transit bucket policy statements that differ only cosmetically from the canonical format (e.g. Principal as {"AWS": "*"} instead of "*").

Enforce Encryption in Transit with Flexible Match for AWS S3 Buckets

main

aws_s3_bucket_encryption_in_transit

Define the Encryption in Transit settings required for `AWS &gt; S3 &gt; Bucket`.&#92;n&#92;nThe Encryption in Transit control compares the Encryption in Transit settings against the Encryption in Transit policies for the resource&#92;n(AWS &gt; S3 &gt; Bucket &gt; Encryption in Transit), raises an alarm, and takes the defined enforcement action.&#92;n&#92;nThe Encryption in Transit control examines the bucket&#39;s policy to find a match for the below statement. An exact match across all statement fields is required for encryption in transit to be considered enabled.&#92;n```&#92;n{&#92;n  Sid: &quot;MustBeEncryptedInTransit&quot;,&#92;n  Effect: &quot;Deny&quot;,&#92;n  Principal: &quot;*&quot;,&#92;n  Action: &quot;s3:*&quot;,&#92;n  Resource: [&#39;arn:${partition}:s3:::${bucketName}&#39;, &#39;arn:${partition}:s3:::${bucketName}/*&#39;],&#92;n  Condition: {&#92;n    Bool: {&#92;n      &quot;aws:SecureTransport&quot;: &quot;false&quot;&#92;n    }&#92;n  }&#92;n}&#92;n```&#92;n

Policy Settings