aws-amplify / aws-amplify/amplify-cli

Amplify Buckets allow HTTP traffic by default

Open
#13,596 1 comment 1 reaction 0 assignees View on GitHub
feature-request ops-deploy
Dominant language
TypeScript
Stars
2.9k
Forks
825
Avg merge
11d 23h
Merged PRs (30d)
2

Description

### Is this feature request related to a new or existing Amplify category?

storage, hosting

### Is this related to another service?

S3

### Describe the feature you'd like to request

https://docs.aws.amazon.com/AmazonS3/latest/userguide/security-best-practices.html

S3 Buckets allow http traffic by default. Per the above link, we should disable http access.

This causes downstream compliance alerts in Security Hub and is needed for customers who have compliance needs.

### Describe the solution you'd like

Add
```
"Condition": {
"Bool": {
"aws:SecureTransport": "false"
}
```

to the bucket policy of the deployment bucket (https://github.com/aws-amplify/amplify-cli/blob/dev/packages/amplify-provider-awscloudformation/resources/rootStackTemplate.json)

### Describe alternatives you've considered

External Automation to achieve this

### Additional context

_No response_

### Is this something that you'd be interested in working on?

- [X] 👋 I may be able to implement this feature request

### Would this feature include a breaking change?

- [ ] ⚠️ This feature might incur a breaking change

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.