DEV Community: Danang Adi Nugroho

S3 Security Best Practices: Require HTTPS and Restrict Access to a VPC Endpoint

Danang Adi Nugroho — Thu, 08 Oct 2026 07:30:35 +0000

Amazon S3 stores a lot of important data, so a weak configuration can expose it to the internet or to unwanted traffic. In this guide I walk through two practical ways I secure an S3 bucket: forcing HTTPS and limiting access to a specific VPC endpoint. It is written for beginners who already have an AWS account and want hands-on steps they can follow.

Prerequisites

Before you start, make sure you have:

An AWS account with access to the AWS Management Console.
A test S3 bucket you can safely experiment with, with at least one object uploaded.
Permissions to edit S3 bucket policies and to create VPC endpoints (for example, administrator access or equivalent IAM permissions).
The AWS CLI installed and configured, so you can run the verification commands.

Throughout this guide I use <YOUR_BUCKET_NAME> for the bucket name and <VPC_ENDPOINT_ID> for the VPC endpoint ID. Replace them with your own values.

Require HTTPS

Why it matters

By default an S3 bucket can accept both HTTP and HTTPS requests. HTTP traffic is not encrypted, so data can be read in transit. This bucket policy denies any request that does not use HTTPS, which protects your data while it moves.

Steps

In the AWS Management Console, use the top search bar to search for and select S3.
1. Click the bucket name.

The S3 object view for the test bucket.

Click the Permissions tab.
Under Bucket policy, click Edit.
1. Copy the bucket policy below and paste it into the bucket policy editor.

   {
       "Id": "S3-Security-Deny-unless-HTTPS",
       "Version": "2012-10-17",
       "Statement": [{
           "Action": "s3:*",
           "Effect": "Deny",
           "Principal": "*",
           "Resource": "arn:aws:s3:::<YOUR_BUCKET_NAME>/*",
           "Condition": {
               "Bool": {
                   "aws:SecureTransport": false
               }
           }
       }]
   }

Replace <YOUR_BUCKET_NAME> with your bucket name.

The bucket policy editor with the HTTPS policy pasted in.

Click Save changes.

How to verify it worked

Test with an HTTP endpoint. This request should fail:

   aws s3api head-object --key [folder-name]/[filename] --endpoint-url http://s3.amazonaws.com --bucket <YOUR_BUCKET_NAME>

The command should return a 403 error, because the endpoint URL uses HTTP.

Now test with an HTTPS endpoint. This request should succeed:

   aws s3api head-object --key [folder-name]/[filename] --endpoint-url https://s3.amazonaws.com --bucket <YOUR_BUCKET_NAME>

The command succeeds. Both commands use s3api, and the only difference is the --endpoint-url. So the bucket policy reacts to the transport, not to the tool.

Restrict Access to an S3 VPC Endpoint

Why it matters

A VPC endpoint lets resources inside your VPC reach S3 over the AWS private network instead of the public internet. This bucket policy denies every request that does not come through your VPC endpoint, so only traffic from your VPC can reach the bucket.

Steps

In the AWS Management Console, use the top search bar to search for and select VPC.
1. In the left column, click Endpoints.
2. Click Create endpoint.
3. Give the endpoint a name.

Naming the endpoint and choosing the AWS services type.

Type S3 in the search bar and press Enter. This filters the list to the S3 endpoints. Select the Gateway type endpoint.

Selecting the S3 Gateway endpoint from the service list.

Under VPC, select your VPC.

Choosing the VPC for the endpoint.

Configure the route tables and set the Policy to Full access.

Selecting the route tables and setting the endpoint policy to Full access.

Click Create endpoint.
1. In the AWS Management Console, use the top search bar to search for and select S3.
Click the bucket name.
Click the Permissions tab.
Under Bucket policy, click Edit.
1. Delete the existing bucket policy. Copy the bucket policy below and paste it into the bucket policy editor.

   {
       "Id": "S3-Security-Deny-unless-VPC-endpoint",
       "Version": "2012-10-17",
       "Statement": [{
           "Action": "s3:*",
           "Effect": "Deny",
           "Resource": "arn:aws:s3:::<YOUR_BUCKET_NAME>/*",
           "Condition": {
               "StringNotEquals": {
                   "aws:sourceVpce": "<VPC_ENDPOINT_ID>"
               }
           },
           "Principal": "*"
       }]
   }

Replace <YOUR_BUCKET_NAME> with your bucket name and <VPC_ENDPOINT_ID> with your endpoint ID.

The bucket policy editor with the VPC endpoint policy pasted in.

Click Save changes.

How to verify it worked

From an EC2 instance inside the VPC, run this command:

   aws s3api head-object --key [folder-name]/[filename] --bucket <YOUR_BUCKET_NAME>

The request succeeds because the EC2 instance can route its S3 request through the VPC endpoint, and the bucket policy allows requests that come through that endpoint.

Clean Up

To avoid leftover resources and keep your account tidy, remove the test resources when you are done:

In the S3 console, open the bucket, go to the Permissions tab, and under Bucket policy click Edit, then delete the policy and click Save changes.
In the VPC console, open Endpoints, select the endpoint you created, and delete it.
If you created a test bucket only for this guide, empty the bucket and then delete it.

Conclusion

Key takeaways:

Force HTTPS with a bucket policy that denies requests when aws:SecureTransport is false.
Restrict access to a VPC endpoint with a bucket policy that denies requests from any other source.
Verify each policy with the AWS CLI before you trust it.
Remove test resources when you finish.

Relevant official AWS documentation:

Passing AWS Cloud Practitioner in 2 Weeks: Study Strategy and Topic Focus

Danang Adi Nugroho — Thu, 01 Oct 2026 11:12:54 +0000

Hi, I'm Danang, a Cloud DevOps Engineer at a cloud services company in Jakarta, Indonesia. This is my first article on Dev.to. I want to share how a beginner can earn a first AWS certification, the AWS Certified Cloud Practitioner (CCP), with just two weeks of preparation.

How It Started: AWS Back-End Academy 2024 Batch 2

The opportunity came in 2024 through the AWS Back-End Academy 2024 Batch 2 program, run by Dicoding, an Indonesian tech learning platform. I was selected as one of the top 40 participants out of hundreds of applicants to receive a global AWS certification token. I received the announcement email on September 21, 2024.

One important note: this program no longer hands out free certification tokens, so please read this part as my personal story, not as an opportunity that is guaranteed to still be available. If you want to study from official sources, AWS Skill Builder offers plenty of learning material, including Cloud Practitioner preparation.

Study Resources

I started studying about two weeks before the exam, which I took on October 18, 2024. The resources I used:

Stéphane Maarek's Udemy course: udemy.com/course/aws-certified-cloud-practitioner-new/
Official AWS documentation: https://docs.aws.amazon.com/
Articles from the internet covering the services that appear in the exam, as a supplement whenever a concept was unclear.

Study Strategy: Fundamentals First, Services Second

The CCP exam (version CLF-C02) is split into four domains with the following weights. Always check the official AWS exam guide, since weights can change in newer exam versions.

Domain	Weight
Cloud Concepts	24%
Security and Compliance	30%
Cloud Technology and Services	34%
Billing, Pricing, and Support	12%

The principle I followed: understand the fundamentals before learning what each service does. So my plan was:

Week 1: Cloud Concepts and Cloud Technology and Services, to build a big-picture view of how the cloud works and what the core services are.
Week 2: Security and Compliance, then finishing the remaining material such as Billing, Pricing, and Support.

It did not go as smoothly as I had imagined. In week two I hit my biggest challenge: the security and compliance domain.

The Biggest Challenge: Security and Compliance

Security was not a familiar topic for me at the time, so I put in extra effort, especially on AWS security best practices and IAM. These are the concepts I found most important to understand:

Shared responsibility model: AWS is responsible for security of the cloud (the infrastructure), while you are responsible for security in the cloud (configuration, data, and access).
IAM (Identity and Access Management): users, groups, roles, and policies. Roles are used for temporary access, for example, so one service can reach another without storing credentials.
Least privilege: grant only the permissions that are truly needed, nothing more.
Root user: protect it with MFA, and do not use it for everyday work.
Other security services worth knowing at a high level: AWS Artifact (compliance reports), GuardDuty (threat detection), Inspector (vulnerability scanning), Shield (DDoS protection), WAF (web request filtering), and KMS (encryption key management).

Exam Day Strategy

I answered the easier questions first. That kept my time under control and left a calmer amount of time for the harder ones.

Result

I passed on my first attempt, and it became my first AWS certification.

Frequently Asked Questions

I also shared this experience at Tech Talk #2 by Dicoding Cloud Community on December 6, 2025. These were the three questions participants asked most:

Where did you study? Official AWS documentation, Stéphane Maarek's video course on Udemy, and supporting articles for the services in the exam.

How long did you study? About two weeks in my case, though it depends on your background and how much time you have each day.

Which topics need extra attention? Security and Compliance, especially IAM and AWS security best practices.

You can see the session documentation here:

Key Takeaways

Start with cloud fundamentals before diving into what each service does.
Two weeks can be enough if your focus is clear, but adjust to your own situation.
Give extra time to Security and Compliance, especially IAM.
On exam day, answer the easier questions first to manage your time.
Always check the official exam guide, because the exam structure can change.

Thanks for reading. If you have questions or your own CCP experience to share, leave a comment. You can also connect with me on LinkedIn.