OBS Buckets Do Not Allow HTTP Requests

Rule Details

Applicable Scenario

This rule prevents data theft and tampering during transmission to OBS.

Solution

To prevent clients from using HTTP to perform OBS operations, you are advised to include the SecureTransport condition in the bucket policy, specifying that only HTTPS requests are allowed. If SecureTransport is set to True, requests must be encrypted using SSL. For details about how to configure Condition and SecureTransport in a bucket policy, see Bucket Policy Parameters.

To block HTTP requests, add the condition: "Condition": {"Bool": {"g:SecureTransport": ["true"]}} to bucket policies.

Rule Logic

• If an OBS bucket denies requests that are not encrypted with SSL, this bucket is compliant.
• If an OBS bucket allows requests that are not encrypted with SSL, this bucket is noncompliant.
• Whether an OBS bucket policy allows requests that are not encrypted with SSL is determined through the SecureTransport or g:SecureTransport parameter.