AWSConfigRemediation-RestrictBucketSSLRequestsOnly - Amazon Systems Manager Automation runbook reference
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).



The AWSConfigRemediation-RestrictBucketSSLRequestsOnly runbook creates an Amazon Simple Storage Service (Amazon S3) bucket policy statement that explicitly denies HTTP requests to the Amazon S3 bucket you specify.

Run this Automation (console)

Document type





Linux, macOS, Windows


  • AutomationAssumeRole

    Type: String

    Description: (Required) The Amazon Resource Name (ARN) of the Amazon Identity and Access Management (IAM) role that allows Systems Manager Automation to perform the actions on your behalf.

  • BucketName

    Type: String

    Description: (Required) The name of the S3 bucket that you want to deny HTTP requests.

Required IAM permissions

The AutomationAssumeRole parameter requires the following actions to use the runbook successfully.

  • ssm:StartAutomationExecution

  • ssm:GetAutomationExecution

  • s3:DeleteBucketPolicy

  • s3:GetBucketPolicy

  • s3:PutEncryptionConfiguration

  • s3:PutBucketPolicy

Document Steps

  • aws:executeScript - Creates a bucket policy for the S3 bucket specified in the BucketName parameter that explicitly denies HTTP requests.