CODEWITHSUNDEEP
amazon-web-servicesamazon-s3
CBurgo
CBurgo

Reputation: 1

Force AMAZON S3 Bucket to download https

Newbie question here so be gentle :) Our membership site has a valid SSL certificate. When I hover over a PDF file in our AWS S3 Bucket - the file also shows as HTTPS.... But when members download a PDF file from that bucket, Google Chrome Developer Tools shows the file is being redirected through a HTTP bucket of the exact same name as the HTTPS one that I hovered over 2 seconds ago....? So we & members are getting the "File can't be downloaded securely" error on Chrome. The file IS Sourced via the S3 Flowshield Plugin on our website - but i'm guessing that's not the issue. It's related to a redirect happening at the AWS level? Is there a way to STOP that redirect? Or force HTTPS on files that are downloaded from the bucket? We don't have AWS CloudFront set up - Not clear on whether we HAVE to - as the files themselves on S3 show as https? (And I'm not sure how that set up might impact the S3 Flowshield delivery?) Thanks in advance for any explanation/solution as I'm still learning. Cheers CBurgo

Upvotes: 0

Views: 724

Answers (1)

jellycsc
jellycsc

Reputation: 12359

You can enforce SSL by adding the following statement to your bucket policy.

{
    "Effect": "Deny",
    "Principal": "*",
    "Action": "s3:*",
    "Resource": [
        "arn:aws:s3:::<bucket-name>",
        "arn:aws:s3:::<bucket-name>/*"
    ],
    "Condition": {
        "Bool": {
            "aws:SecureTransport": "false"
        }
    }
}

Upvotes: 1

Related Questions