CloudFormation例

当たり前ではあるが、ダメなものをとにかく弾けばOK。

# ...略...
Resources:
  MyS3Bucket:
    Type: AWS::S3::Bucket
    Properties:
      # ...略...

  MyS3BucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref MyS3Bucket
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Deny
            Principal: '*'
            Action: 's3:*'
            Resource:
              - !GetAtt MyS3Bucket.Arn
              - !Sub ${MyS3Bucket.Arn}/*
            Condition:
              Bool:
                'aws:SecureTransport': 'false'
          - Effect: Deny
            Principal: '*'
            Action: 's3:*'
            Resource:
              - !GetAtt MyS3Bucket.Arn
              - !Sub ${MyS3Bucket.Arn}/*
            Condition:
              NumericLessThan:
                's3:TlsVersion': '1.2'
# ...略...