{
  "Comment": "The S3 bucket policy this sample applies to its own backing bucket. setup.sh renders <S3_BUCKET_ARN> before applying it with `aws s3api put-bucket-policy`. It denies any access that is not over TLS. The sample does not grant the optional direct read-from-S3 optimization, which would otherwise be an Allow here; the mount and all reads still work over NFS without it. The EC2 node instance-profile role is not named here: a managed Auto Mode node role must keep what it ships with and is neither read nor granted nor denied by this sample; the file system is already default-deny, authorized only through the sample's own file system policy per access point.",
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyInsecureTransport",
      "Effect": "Deny",
      "Principal": "*",
      "Action": "s3:*",
      "Resource": [
        "<S3_BUCKET_ARN>",
        "<S3_BUCKET_ARN>/*"
      ],
      "Condition": {
        "Bool": { "aws:SecureTransport": "false" }
      }
    }
  ]
}