How to Enforce HTTPS for S3 GetObject Requests Using Bucket Policy

Quick Answer

The effect of this policy comes down to reading the Deny statement precisely: it applies specifically to the s3:GetObject action and is conditioned on aws:SecureTransport being false, the flag AWS sets when a request arrives over plain HTTP rather than HTTPS. Because the Deny is scoped narrowly to GetObject and to the SecureTransport condition, it only blocks read requests made without TLS; it says nothing about PutObject, so uploads are unaffected regardless of protocol, and it says nothing about source IP address, so GetObject requests over HTTPS succeed no matter where they originate. The habit worth building is reading every Deny statement as a precise intersection of three things: the action it names, the condition it evaluates, and what is left untouched because it was never mentioned. It's easy to over-read a security policy and assume it does more than it says, for example assuming a policy enforcing encryption in transit also restricts write access or filters by IP, when it only does exactly what its Action and Condition blocks specify. Whenever a bucket-policy question asks you to determine the effect of a policy, resist imagining additional protections a security-conscious engineer might have intended, and work strictly from what the Action, Effect, and Condition keys actually say, since exam questions frequently test whether you notice a policy's narrow, literal scope rather than its likely intent.