Require HTTPS and keep an S3 bucket inside your organization

Simulate both statements before applying

simulate-custom-policy can evaluate the bucket policy together with a caller's identity policy (caller-allow.json, granting s3:GetObject). You supply the context values, so you can flip one at a time. Always pass the organization ID: with IfExists operators, leaving it out makes the caller look like an outsider.

aws iam simulate-custom-policy --policy-input-list file://caller-allow.json --resource-policy file://bucket-policy.json --caller-arn arn:aws:iam::111122223333:role/<role-name> --action-names s3:GetObject --resource-arns arn:aws:s3:::amzn-s3-demo-bucket/<test-key> --context-entries ContextKeyName=aws:SecureTransport,ContextKeyValues=false,ContextKeyType=boolean ContextKeyName=aws:PrincipalOrgID,ContextKeyValues=o-exampleorgid,ContextKeyType=string --query 'EvaluationResults[].EvalDecision' --output text
aws iam simulate-custom-policy --policy-input-list file://caller-allow.json --resource-policy file://bucket-policy.json --caller-arn arn:aws:iam::111122223333:role/<role-name> --action-names s3:GetObject --resource-arns arn:aws:s3:::amzn-s3-demo-bucket/<test-key> --context-entries ContextKeyName=aws:SecureTransport,ContextKeyValues=true,ContextKeyType=boolean ContextKeyName=aws:PrincipalOrgID,ContextKeyValues=o-exampleorgid,ContextKeyType=string --query 'EvaluationResults[].EvalDecision' --output text

Expected: explicitDeny for the first call (HTTP) and allowed for the second (HTTPS, inside the organization). Removing the aws:PrincipalOrgID entry from the second call should turn it into explicitDeny. The simulator only evaluates the values you pass; it does not look up real organization membership.

Prove HTTP is refused with a request S3 would otherwise accept

An anonymous curl to an http:// URL is refused with or without this policy, so it proves nothing. A presigned URL does: it carries your signature, and the scheme isn't part of the SigV4 canonical request, so the same URL is valid over both schemes and only the bucket policy tells them apart. Use a short expiry and a non-sensitive object, since over HTTP the URL travels in clear text. The last command does the same with the CLI against the plain-HTTP endpoint.

URL=$(aws s3 presign s3://amzn-s3-demo-bucket/<test-key> --expires-in 60 --profile <profile>)
curl -s -o /dev/null -w '%{http_code}\n' "$URL"
curl -s "${URL/https:/http:}"
aws s3api list-objects-v2 --bucket amzn-s3-demo-bucket --max-keys 1 --endpoint-url http://s3.<region>.amazonaws.com --profile <profile>

Expected: 200 over HTTPS. Over HTTP, an XML error body with Code AccessDenied, and the CLI call fails with AccessDenied. Because the signer is in the bucket owner's account, the message usually adds that the denial came from an explicit deny in a resource-based policy. If the HTTP request never reaches S3 (a proxy or firewall blocking port 80), the test is inconclusive.

Check the perimeter honestly

From outside the organization you can't observe much: without an Allow for that account the request was denied anyway, and S3 gives callers outside the owner's account or organization only a generic Access Denied. Verify from the owner's side instead. An external access analyzer with the organization as zone of trust reports buckets whose policies admit outside principals; this bucket should have none. CloudTrail data events in the owner's account can show denied requests from outside accounts, though AWS notes some access-denied entries are redacted or omitted.

aws accessanalyzer list-findings-v2 --analyzer-arn <org-analyzer-arn> --filter '{"resource": {"eq": ["arn:aws:s3:::amzn-s3-demo-bucket"]}, "status": {"eq": ["ACTIVE"]}}'

Expected: An empty findings list for the bucket after the next analysis (AWS documents up to 30 minutes after a policy change). A remaining finding names the outside principal and the condition under which it has access; read it before archiving. Access Analyzer doesn't report access by AWS service principals, which this policy deliberately exempts.

Replacing instead of merging

Pasting these two statements in as the whole policy silently removes every existing Allow, such as a CloudFront OAC grant.

Writing the perimeter with NotPrincipal or without the service exemption

You can't use NotPrincipal to exempt AWS service principals, and a perimeter without the aws:PrincipalIsAWSService test also blocks service deliveries such as server access logs and CloudTrail. Those failures are quiet: logs simply stop arriving.

Adding an s3:TlsVersion floor that adds nothing or breaks clients

AWS documents TLS 1.2 and 1.3 as the versions S3 endpoints support, so a NumericLessThan 1.2 floor mostly restates what the endpoints already enforce. A 1.3 floor bites, but AWS notes TLS 1.3 isn't supported through AWS PrivateLink for S3 or Multi-Region Access Points, so it breaks clients on those paths.

Breaking partners and public content

Anonymous requests have no organization ID, so this policy also ends any public or presigned-URL-by-outsider access. Presigned URLs still work when the signer is inside the organization, because the request is evaluated as the signer.