securing-s3-buckets
This skill guides you through five core workflows: securing new buckets, auditing existing configurations, remediating findings, configuring encryption, and enabling monitoring. It enforces layered security controls aligned with AWS Well-Architected principles, including versioning, encryption defaults, HTTPS-only policies, and attribute-based access control.
Securing S3 Buckets helps you create and protect new S3 buckets with AWS best practices for access control, encryption, and monitoring.
AI-generated summary based on this skill's SKILL.md
Install
aws/agent-toolkit-for-aws/securing-s3-buckets · repository language: Python
git clone https://github.com/aws/agent-toolkit-for-aws
cp -r agent-toolkit-for-aws/skills/specialized-skills/storage-skills/securing-s3-buckets ~/.claude/skills/securing-s3-bucketsFrequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
How to secure S3 bucket following AWS best practices?
Securing S3 buckets involves layered controls: enable versioning and MFA Delete, enforce encryption (S3-managed or KMS), block all public access via bucket settings, implement HTTPS-only policies, enable logging to CloudTrail and S3 access logs, and configure attribute-based access control (ABAC). This skill walks through each step aligned with AWS Well-Architected principles to protect data at rest and in transit.
What are the key steps to audit S3 bucket configuration?
Securing S3 buckets requires reviewing: encryption status (default or KMS), public access block settings, bucket policies restricting to HTTPS, versioning and MFA Delete enablement, logging destinations, and IAM/resource-based permissions. This skill provides a checklist to identify misconfigurations, verify compliance requirements, and spot gaps in monitoring or access controls.
How do I enable encryption and monitoring on S3 buckets?
Securing S3 buckets includes enabling default encryption (S3-managed or KMS), configuring S3 access logging to a separate bucket, enabling CloudTrail for API auditing, and optionally setting up CloudWatch alarms. This skill guides you through each configuration, ensuring encrypted data at rest, audit trails for access, and visibility into bucket operations.
How can I remediate S3 security findings and misconfigurations?
Securing S3 buckets after finding issues means: blocking public access, adding bucket policies to deny insecure transport, enabling versioning and MFA Delete, applying encryption defaults, and updating IAM roles to follow least-privilege principles. This skill provides step-by-step remediation workflows to close gaps identified in audits or security assessments.
What is S3 bucket policy HTTPS only and how do I enforce it?
Securing S3 buckets with HTTPS-only access means adding a deny policy for requests using insecure transport (aws:SecureTransport = false). This skill shows how to craft and apply bucket policies that reject HTTP connections, ensuring all data in transit is encrypted and meeting compliance requirements for secure communication.
How does securing S3 buckets include attribute-based access control?
Securing S3 buckets with ABAC lets you grant permissions based on tags (environment, team, cost-center) rather than individual identities. This skill demonstrates how to tag resources, define IAM policies using tag conditions, and scale access management across teams while maintaining least-privilege security posture.
SKILL.md
rendered from the published skill — quoted content, verbatim
Overview
Implements layered S3 security controls across five workflows: securing new buckets, auditing existing configurations, remediating findings, configuring encryption, and enabling monitoring. Follows AWS Well-Architected security best practices.
Execute commands using the AWS MCP server when connected (sandboxed execution, audit logging, observability). Fall back to AWS CLI or shell otherwise.
Common Tasks
0. Verify Dependencies
Check for required tools before starting.
Constraints:
- You MUST inform the user if required tools are missing
- You SHOULD confirm credentials with
aws sts get-caller-identity
See references/iam-permissions.md for IAM permissions by
(truncated - see the full file via the links below)
Read as markdown · JSON record · Browse the source repository
File tree — 6 files
skills/specialized-skills/storage-skills/securing-s3-buckets/SKILL.md
skills/specialized-skills/storage-skills/securing-s3-buckets/references/audit-checklist.md
skills/specialized-skills/storage-skills/securing-s3-buckets/references/encryption.md
skills/specialized-skills/storage-skills/securing-s3-buckets/references/iam-permissions.md
skills/specialized-skills/storage-skills/securing-s3-buckets/references/remediation.md
skills/specialized-skills/storage-skills/securing-s3-buckets/references/workflows.md