{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "RequireEncryptedTransport",
      "Effect": "Deny",
      "Principal": "*",
      "Action": "s3:*",
      "Resource": "arn:aws:s3:::my-secure-bucket/*",
      "Condition": {
        "Bool": {
          "aws:SecureTransport": "false"
        }
      }
    }
  ]
}

{
  "if": {
    "field": "type",
    "equals": "Microsoft.Storage/storageAccounts"
  },
  "then": {
    "effect": "auditIfNotExists",
    "details": {
      "type": "Microsoft.Storage/storageAccounts/blobServices",
      "existenceCondition": {
        "field": "Microsoft.Storage/storageAccounts/blobServices/cors.corsRules[*].allowedOrigins[*]",
        "notEquals": "*"
      }
    }
  }
}