json 18 lines · 1 tab

S3 bucket policy that enforces TLS and blocks public reads

Kai Nakamura Apr 2026

1 tab

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyInsecureTransport",
      "Effect": "Deny",
      "Principal": "*",
      "Action": "s3:*",
      "Resource": [
        "arn:aws:s3:::codesnips-assets-production",
        "arn:aws:s3:::codesnips-assets-production/*"
      ],
      "Condition": {
        "Bool": { "aws:SecureTransport": "false" }
      }
    }
  ]
}

1 file · json Explain with highlit

Public cloud storage needs explicit safety rails because the defaults are not enough by themselves. I deny insecure transport, block public access at the account level, and scope principals tightly. Storage mistakes are still one of the easiest ways to cause a quiet data leak.

Related snips

hcl

# AWS Lambda Function with API Gateway trigger

# === Lambda function ===
resource "aws_lambda_function" "api_handler" {
  function_name = "${var.project}-api-handler"
  description   = "API request handler for ${var.project}"

AWS Lambda serverless functions with Terraform

aws lambda serverless

by Ryan Nakamura 1 tab

json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:GetObject"],

Least privilege IAM policy for an application on AWS

aws iam least-privilege

by Kai Nakamura 1 tab

package files

import (
  "context"
  "time"

Presigned S3 upload URLs (AWS SDK v2)

go aws s3

by Leah Thompson 1 tab

ruby

# Installation
# rails active_storage:install
# rails db:migrate

# config/storage.yml
local:

ActiveStorage for file uploads and attachments

ruby rails active-storage

by Sarah Mitchell 2 tabs

package deps

import (
  "crypto/tls"
  "crypto/x509"
  "net/http"

mTLS client configuration with custom root CA pool

go security tls

by Leah Thompson 1 tab

hcl

# RDS PostgreSQL instance
resource "aws_db_instance" "main" {
  identifier = "${var.project_name}-db"

  engine         = "postgres"
  engine_version = "16.1"

Terraform AWS RDS and ElastiCache provisioning

terraform aws rds

by Ryan Nakamura 1 tab

Share this code

Here's the card — post it anywhere.

S3 bucket policy that enforces TLS and blocks public reads — share card

Link copied