A company that builds document management systems recently performed a security review of its application...

Comprehensive and Detailed 100to 150 words of Explanation From AWS Certified Security – Specialty topics:

The enforceable control is an S3 bucket policy that denies requests when the global condition key aws:SecureTransport is false. That condition evaluates whether the request was sent over HTTPS/TLS. A deny statement is evaluated before any allow statement, so even a signed URL cannot be used over an unencrypted transport path. Telling clients to use HTTPS is not a preventive AWS-side control. AWS Config’s s3-bucket-ssl-requests-only managed rule can detect noncompliant bucket policy configuration, but it does not itself block an insecure upload request. An ACL granting AllUsers WRITE would be dangerously wrong and would increase exposure. The bucket policy deny is the direct security enforcement mechanism for encryption in transit.

================