OSS supports accessing bucket resources over both HTTPS and HTTP. However, HTTP access introduces security vulnerabilities. To protect your OSS resources from attacks, use HTTPS to access them and reject all HTTP requests. This topic describes how to use a bucket policy to allow access to OSS resources only over HTTPS.
Background information
You can use a bucket policy to require all users to access bucket resources over HTTPS. RAM policies are user-based authorization policies that apply only to users and cannot authorize access to resources such as buckets or objects. The following policy denies all users—including authorized users and anonymous users—from accessing a specific bucket over HTTP.
Procedure
Log on to the OSS console.
In the left navigation pane, click Bucket list, then click the bucket name.
In the left navigation pane, choose Access control > Bucket policy.
On the Bucket policy tab, click Add policy.
In the Add policy panel, set the following parameters.
Resource: Entire bucket.
Authorized user: All accounts (*).
Operation: Deny access.
Access method under Condition: HTTP.
Click OK to allow access to OSS resources only over HTTPS.