Q:

Security of using HTTPS based services on an HTTP site

This question has come up at my job a few times, and I was hoping to get some community backing. 
We are working on a Single Page WebApp, but require that the data coming from our services API be secure to prevent snooping of the data.  We are also trying to iron out the prod environment details for where our SPA will be hosted.  One of the options is using something like Amazon's S3, which doesn't support SSL (to my knowledge). 
There's a group that believes the whole site needs to be hosted over SSL.  However, it's my understanding that SSL will only protect the transmission of the data.  So the point I'm trying to make is that hosting the services from an HTTPS site and the client code from non-SSL based URLs will be just as secure as hosting everything from an SSL site. 
Could anyone clarify this for me? 
Thanks in advance. 

A:

Yes, SSL just encrypts the transmission of the data, and does not offer any type of protection of the runtime environment on any client-side code. 
Now, it is generally considered a best practice to host everything over SSL, for these reasons:

Users can get warnings that a site is transmitting data with an untrusted source if parts are from SSL and parts are not. 
Any cookies, will be sent in the clear when requesting the non-SSL files and may contain information that should be kept private.