The most direct and effective method to enforce encryption in transit for all requests to an Amazon S3 bucket is by using a resource-based policy attached to the bucket itself. The aws:SecureTransport global condition key is specifically designed for this purpose. By creating a bucket policy with a Deny effect for all actions (s3:) when the aws:SecureTransport condition is false, you explicitly block any request made over an unencrypted channel (HTTP). This single policy ensures that all principals, including those from other AWS accounts, must use HTTPS to access the objects, fulfilling the security requirement centrally and authoritatively.

B. This policy would explicitly allow insecure (HTTP) requests, which is the direct opposite of the stated security requirement.

C. Managing individual IAM policies in multiple external accounts is not scalable, is prone to error, and violates the principle of the resource owner controlling access.

D. The policy should be on the S3 bucket because the s3:GetObject request is made to the S3 service endpoint; the aws:SecureTransport key evaluates the user's connection to S3, not the backend connection from S3 to KMS.

1. Amazon S3 User Guide: Under the section "Security best practices for Amazon S3

" the guide provides a specific example of a bucket policy to enforce encryption in transit. It states

"To enforce encryption in transit

you can use the aws:SecureTransport condition key in your S3 bucket policies... The following example bucket policy denies access to any HTTP request..." This directly validates option A.

Source: AWS Documentation

Amazon S3 User Guide

"Security best practices for Amazon S3

" section "Enforce encryption in transit."

2. AWS IAM User Guide: This guide documents the aws:SecureTransport key as a global condition context key. It explains that this key checks "whether the request was sent using SSL" and can be used in policies to allow actions only when the request is made using HTTPS.

Source: AWS Documentation

IAM User Guide

"AWS global condition context keys

" section for aws:SecureTransport.

3. AWS Security Blog: The post "How to Use New S3 Features to Bolster the Security of Your S3 Buckets" details using the aws:SecureTransport condition in a bucket policy as a primary method to enforce HTTPS.

Source: AWS Security Blog

"How to Use New S3 Features to Bolster the Security of Your S3 Buckets

" July 26

2017.