awsdocs/amazon-s3-userguide

s3:TlsVersion condition example grants access to any (anonymous) users

oedm opened this issue · 2 comments

oedm commented

The second example of Example 8: Requiring a minimum TLS version shows an use case which grants access to upload files to everyone ("Principal": "*") if they match the condition of the TLS Version.
In my opinion, this is a poor example inside the official documentation, since inexperienced users could simple copy & paste that example without realizing they open up their bucket to the whole world.

I would like to suggest to expand that example with an IAM role (pull request will follow) in order to mitigate this risky bucket policy.

Thanks!
Marcel

Thank you for your request. I'll review your pull request and use that to track the status of the update.

oedm commented

Hi @DBirtolo-AMZ,
sorry to bother you afterwards, but the change is still not published onto the official web page after arround 6 months.

best regards
Marcel