mediumMultiple Choice

S3 Bucket Policy: Deny HTTP Requests

Exhibit

Refer to the exhibit.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Principal": "*",
      "Action": "s3:*",
      "Resource": "arn:aws:s3:::my-bucket/*",
      "Condition": {
        "Bool": {
          "aws:SecureTransport": "false"
        }
      }
    }
  ]
}

An administrator applies the above bucket policy to an S3 bucket containing sensitive data. What is the EFFECT of this policy?

Quick Answer

The correct answer is that the policy denies access if the request does not use HTTPS. This is because the S3 bucket policy uses a Deny effect paired with the aws:SecureTransport condition set to false, which explicitly blocks any request made over plain HTTP while allowing only encrypted HTTPS traffic. On the Certified Cloud Security Professional CCSP exam, this scenario tests your understanding of how to enforce encryption in transit using bucket policies, a key control for protecting sensitive data in cloud storage. A common trap is confusing this with a condition that allows HTTP; remember that setting SecureTransport to false triggers the Deny, so the policy acts as a gate that rejects unencrypted requests. For a quick memory tip, think of it as “Deny when not secure”—if the transport isn’t secure (HTTPS), access is denied.

⚠ Common exam trap

ISC2 often tests the distinction between `Deny` and `Allow` effects in S3 bucket policies, and the trap here is that candidates misread the condition as denying HTTPS instead of denying non-HTTPS, or they assume the policy grants public access because they overlook the absence of an `Allow` statement.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Denies access if the request does not use HTTPS

The bucket policy uses a `Deny` effect with a condition `aws:SecureTransport` set to `false`, which means any request that does not use HTTPS (i.e., plain HTTP) is denied. This enforces encryption in transit for all access to the S3 bucket, ensuring sensitive data is not transmitted over an unencrypted channel. Option C correctly identifies that the policy denies access if the request does not use HTTPS.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Allows public read access
Why it's wrong here
The policy's Principal and condition elements determine its effect; a wildcard principal with no restricting condition grants broad anonymous access, but that is not automatic. Public read access arises only when the statement explicitly permits s3:GetObject to everyone.
✗
Allows access only from specific IP addresses
Why it's wrong here
An IP-based condition restricts requests to those source addresses, yet the policy's actual Principal and Action statements decide whether access is granted at all. Source-address conditions are correct for locking a bucket to a corporate network range.
✓
Denies access if the request does not use HTTPS
Why this is correct
The policy's condition evaluates the aws:SecureTransport key; when the request arrives over plain HTTP, that condition is false, so the explicit Deny statement takes effect. This blocks any non-TLS access to the sensitive bucket contents.
✗
Denies access if the request uses HTTPS
Why it's wrong here
An HTTPS-only condition denies requests made over plain HTTP, not HTTPS, so this reverses the policy's actual effect. It is tempting because enforcing TLS is a common S3 hardening goal, and a Deny statement with a Bool aws:SecureTransport false condition would be the right construct for that requirement.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

1 more way this is tested on CCSP

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. A security engineer applies the above bucket policy to an S3 bucket containing sensitive data. Which of the following best describes the effect of this policy?

hard

A.It allows all access to the bucket.
B.It denies access to objects over HTTPS, but allows HTTP.
✓ C.It denies access to objects over HTTP, but allows HTTPS.
D.It denies all access to the bucket.

Why C: The bucket policy uses a `Deny` effect with a `Condition` block that checks `aws:SecureTransport` equals `false`. This condition denies access when the request is made over HTTP (non-secure transport), effectively blocking HTTP requests while allowing HTTPS requests. The policy does not affect HTTPS requests because the condition only triggers when `SecureTransport` is false.

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.