How do I enforce using TLS 1.2 or later for my Amazon S3 buckets?
My customers use earlier TLS versions. I want to enforce using a recent TLS version when they access content that’s stored in my Amazon Simple Storage Service (Amazon S3) buckets.
"My customers use earlier TLS versions. I want to enforce using a recent TLS version when they access content that’s stored in my Amazon Simple Storage Service (Amazon S3) buckets.Short descriptionIt's a best practice to use modern encryption protocols for data in transit. To enforce the use of TLS version 1.2 or later for connections to Amazon S3, update your bucket's security policy.Note: If your customers don’t use TLS version 1.2 or later, then they can't access content that's stored in your S3 buckets.ResolutionUse a resource-based policy that's attached to your bucket to enforce using TLS 1.2 or later for all connections to your S3 buckets.To attach a bucket policy that requires TLS versions 1.2 or later, complete the following steps:Open the Amazon S3 console.Select the bucket from the list.Choose the Permissions tab.Under Bucket Policy, choose Edit.Add a policy to deny access to the encryption protocols that you want to prevent. For example, use the following policy to deny all HTTPS requests that use TLS versions that are earlier than 1.2:{  "Version": "2012-10-17",  "Statement": [    {      "Sid": "EnforceTLSv12orHigher",      "Principal": {        "AWS": "*"      },      "Action": ["s3:*"],      "Effect": "Deny",      "Resource": [        "arn:aws:s3:::DOC-EXAMPLE-BUCKET/*",        "arn:aws:s3:::DOC-EXAMPLE-BUCKET"      ],      "Condition": {        "NumericLessThan": {          "s3:TlsVersion": 1.2        }      }    }  ]}The preceding policy enforces HTTPS to increase security for your data in transit. If your workload requires HTTP traffic to Amazon S3, then use the preceding policy with the following condition. This condition allows HTTP traffic and blocks HTTPS traffic from TLS versions 1.2 and earlier:"Condition": {        "Bool": {            "aws:SecureTransport": "true"        },        "NumericLessThan": {          "s3:TlsVersion": 1.2        }      }Confirm that you're using modern encryption protocols for S3To test your new policy, use the following example curl command to make HTTPS requests that use a specific legacy protocol:curl https://${BUCKET\_NAME}.s3.us-east-1.amazonaws.com/image.png -v --tlsv1.0 --tls-max 1.0The example curl command returns Access Denied because Amazon S3 detects that your request isn't using TLS version 1.2 or later.Note: By default curl sends an anonymous request. If your bucket is private, then you receive a 403 Access Denied error for any TLS version. When using curl to test, generate an Amazon S3 presigned URL to gain access to your private objects.It's a best practice to use AWS CloudTrail Lake to identify earlier TLS connections to AWS service endpoints. You can configure the CloudTrail Lake event data store to capture management events or data events.Follow"