market-payroll-1g3xpud holds payslips/march.csv. The security review asks two things.
- Ask S3 how the payslip is encrypted at rest, and decide whether that meets payroll's wishes.
- Requests over plain HTTP must be refused. A colleague started a bucket policy in
~/https-only.json, but it does not refuse anything yet. Read it, fix it, and put it on the bucket.