S3 Bucket Policy to Enforce HTTPS: Object-Level Deny vs Bucket-Level Deny
Exhibit
Refer to the exhibit.
Resources:
MyBucket:
Type: AWS::S3::Bucket
Properties:
VersioningConfiguration:
Status: Enabled
MyBucketPolicy:
Type: AWS::S3::BucketPolicy
Properties:
Bucket: !Ref MyBucket
PolicyDocument:
Version: 2012-10-17
Statement:
- Effect: Deny
Action: s3:*
Principal: '*'
Resource: !Sub '${MyBucket.Arn}/*'
Condition:
Bool:
aws:SecureTransport: 'false'A company deploys the above CloudFormation stack. They want to enforce HTTPS for all requests to the S3 bucket. After deployment, users are still able to make HTTP requests. What is the problem?
Quick Answer
The answer is that the Deny statement's Resource specifies only the objects, not the bucket itself. This is the classic "object-level vs bucket-level" policy trap: the Deny condition on `aws:SecureTransport` applies only to the object ARN (`arn:aws:s3:::bucket/*`), so actions targeting the bucket resource itself—like `s3:ListBucket` or `s3:GetBucketLocation`—are not denied, and HTTP requests for those operations succeed. On the AWS Certified DevOps Engineer Professional DOP-C02 exam, this tests your understanding that an S3 bucket policy to enforce HTTPS only on objects must include both the bucket ARN and the object ARN in the Resource element to cover all actions. A common trap is assuming a single wildcard resource covers everything, but the bucket and its objects are separate ARNs. Memory tip: "Bucket and objects, two ARNs for full HTTPS locks."
⚠ Common exam trap
Many candidates assume a Deny statement on `/*` covers all requests, but they overlook that the bucket ARN itself must be explicitly included to enforce HTTPS on bucket-level operations, not just object operations.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The Deny statement's Resource specifies only the objects, not the bucket itself
The Deny statement in the bucket policy uses `arn:aws:s3:::example-bucket/*` as the Resource, which applies only to objects within the bucket, not to the bucket itself. To enforce HTTPS for all requests, including those to the bucket endpoint (e.g., `GET /` or `PUT /`), the Resource must also include the bucket ARN without the `/*` suffix. Without it, HTTP requests targeting the bucket itself (such as listing objects or configuring website hosting) are not denied, allowing HTTP access to bypass the policy.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The condition key 'aws:SecureTransport' is misspelled; it should be 'aws:SecureTransport' with a capital 'T'
Why it's wrong here
The condition key is correct.
- ✗
The bucket is not versioned, so the policy does not apply to object versions
Why it's wrong here
Versioning does not affect the HTTPS enforcement.
- ✗
The policy uses Deny, but an Allow policy from another statement overrides it
Why it's wrong here
Deny always overrides Allow.
- ✓
The Deny statement's Resource specifies only the objects, not the bucket itself
Why this is correct
The Resource does not include the bucket ARN, so bucket-level operations like ListBucket are not denied.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 251 original DOP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DOP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A DevOps team uses the above CloudFormation template to create an S3 bucket. What does the bucket policy accomplish?
easy- ✓ A.It denies all S3 operations on the bucket unless the request uses HTTPS.
- B.It denies all read access to the bucket for anonymous users.
- C.It prevents anyone from deleting objects in the bucket.
- D.It allows only HTTPS requests to the bucket and denies all HTTP requests.
Why A: The bucket policy uses a Deny effect with a condition that the request must use HTTPS (SecureTransport: false). This denies all S3 operations on the bucket unless the request is sent over HTTPS. Option B is incorrect because the policy does not target anonymous users specifically; it applies to all principals. Option C is incorrect because the policy denies all actions, not just delete. Option D is incorrect because it allows HTTP requests when the condition is not met, but the Deny overrides; the policy explicitly denies non-HTTPS requests.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.