S3 bucket does not require TLS

What it means

The bucket policy does not deny requests where `aws:SecureTransport` is false, so plain HTTP requests are accepted.

Why it matters

An unencrypted request carries the object contents and the signed authorization header across the network in the clear. On a laptop in a cafe, that is a credential someone else can replay.

How to fix it

Set `enforceSSL: true` on the Bucket, which adds the explicit deny to the bucket policy.

See it fail

This stack trips AwsSolutions-S10 for real. Open it in the playground, press Run, and the finding appears with everything else the engine has to say about it.

Other rules