aws-s3
AWS S3 equips you with production-grade bucket configuration, from hardening with encryption and public access blocks to enforcing policies and setting up cross-region replication. Handle lifecycle transitions, presigned URLs, and access control in one skill.
AWS S3 helps you configure buckets with security, encryption, versioning, and access controls for AWS object storage.
AI-generated summary based on this skill's SKILL.md
Install
BagelHole/DevOps-Security-Agent-Skills/aws-s3 · repository language: Shell
git clone https://github.com/BagelHole/DevOps-Security-Agent-Skills
cp -r DevOps-Security-Agent-Skills/infrastructure/cloud-aws/aws-s3 ~/.claude/skills/aws-s3Frequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
How do you create and secure an S3 bucket with aws-s3?
aws-s3 guides you through bucket creation with security hardening: enable versioning and encryption (SSE-S3 or KMS), activate public access blocks to prevent accidental exposure, and configure bucket policies to enforce HTTPS-only access. The skill covers setting object-level permissions and implementing least-privilege access controls for production environments.
What lifecycle rules and storage class transitions does aws-s3 support?
aws-s3 helps you set up lifecycle rules to automatically transition objects between storage classes—moving to GLACIER for archival or INTELLIGENT_TIERING for cost optimization. You can configure expiration policies to delete old versions or incomplete multipart uploads, reducing storage costs while maintaining compliance and data retention requirements.
How can aws-s3 enable cross-region replication for disaster recovery?
aws-s3 walks you through configuring cross-region replication (CRR) to automatically copy objects to a secondary region, ensuring high availability and disaster recovery. The skill covers replication metrics, status monitoring, and failover strategies so your data remains accessible even if a region becomes unavailable.
How do presigned URLs in aws-s3 provide temporary secure access?
aws-s3 explains presigned URLs—time-limited, cryptographically signed URLs that grant temporary access to private S3 objects without exposing credentials. Use them for downloads, uploads, or sharing sensitive data with external users; the skill covers URL expiration, permission scoping, and security best practices.
How does aws-s3 help troubleshoot S3 access denied errors?
aws-s3 provides diagnostics for common access issues: verify bucket policies and IAM roles, check public access block settings, confirm encryption key permissions (for KMS), and validate cross-account policies. The skill guides you through policy evaluation logic and logging configuration to identify permission mismatches quickly.
What S3 bucket policies enforce HTTPS and restrict access with aws-s3?
aws-s3 demonstrates bucket policies that deny non-HTTPS requests, restrict access by VPC endpoint, enforce specific IAM principals, and block public uploads. The skill shows policy syntax, condition operators, and validation techniques to ensure only authorized, encrypted traffic reaches your buckets.
SKILL.md
rendered from the published skill — quoted content, verbatim
AWS S3
Manage Amazon S3 object storage with production-grade security, lifecycle policies, replication, and access controls.
When to Use This Skill
- Creating S3 buckets with security hardening (encryption, public access block, versioning)
- Writing bucket policies to enforce HTTPS, restrict IP ranges, or grant cross-account access
- Setting up lifecycle rules to transition objects between storage classes
- Configuring cross-region replication for disaster recovery
- Generating presigned URLs for temporary access to private objects
- Setting up static website hosting or CloudFront origins
- Troubleshooting access denied errors or policy conflicts
Prerequisites
- AWS CLI v2 installed and configured
- IAM permissions:
s3:*,s3-object-lambda:*,kms:*(for SSE-KMS) - For replication: IAM role with replication permissions and destination bucket in target region
- For logging: a separate logging bucket with appropriate ACL
(truncated - see the full file via the links below)
Read as markdown · JSON record · Browse the source repository
File tree — 1 file
infrastructure/cloud-aws/aws-s3/SKILL.md