SCS-C02 Infrastructure Security Practice Question

A company wants to ensure that all data sent to an S3 bucket is encrypted in transit. Which policy statement should be added to the bucket policy?

⚠ Common exam trap

SCS-C02 often tests the difference between Allow and Deny effects and the logical inversion of condition keys, so candidates may mistakenly choose an Allow statement with aws:SecureTransport true, not realizing that an explicit Deny is required to block insecure requests when other allows exist.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Deny if aws:SecureTransport is false

Deny if aws:SecureTransport is false. The aws:SecureTransport condition key evaluates to true when the request is made over HTTPS (TLS) and false when made over HTTP. To enforce encryption in transit, you must explicitly deny requests where aws:SecureTransport is false, ensuring that any unencrypted HTTP request is rejected. This is the standard pattern for S3 bucket policies to enforce TLS-only access.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Allow if aws:SecureTransport is false
Why it's wrong here
This statement explicitly permits only requests where aws:SecureTransport is false, meaning it allows plaintext HTTP and denies every HTTPS request because the condition matches only the false value. That inverts the security requirement by forcing clients to send data insecurely and blocking encrypted traffic. A correct policy must explicitly deny the false condition rather than allow it.
✗
Deny unless aws:SecureTransport is false
Why it's wrong here
Using "Deny unless aws:SecureTransport is false" is logically equivalent to denying any request where SecureTransport is true, so it blocks all HTTPS traffic and leaves HTTP permitted. This is the exact opposite of the desired behavior: you want to deny the insecure case (false) and allow the secure case (true). The keyword "unless" reverses the condition, a subtle point that can easily cause a policy to do the wrong thing.
✗
Allow if aws:SecureTransport is true
Why it's wrong here
Allowing when aws:SecureTransport is true grants access to HTTPS requests, but it does not deny HTTP requests. If another statement in the bucket policy (or an ACL/Grant) allows access generally, HTTP requests will still succeed because an Allow with a condition never implicitly denies requests that do not match the condition. Only an explicit Deny can block insecure transport, so this statement alone is insufficient for the requirement.
✓
Deny if aws:SecureTransport is false
Why this is correct
This is the correct pattern because it explicitly denies every request where aws:SecureTransport is false, i.e., plaintext HTTP, while leaving HTTPS requests unaffected and able to be allowed by other statements. An explicit Deny always overrides any Allow, so even a broad bucket policy cannot accidentally permit insecure HTTP traffic. This is the standard, recommended way to enforce TLS for S3 data in transit.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

SCS-C02 Infrastructure Security Practice Question

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question