s3-estate-calibration-auditor

What problem does it solve?

Security teams reviewing AWS S3 estates frequently encounter buckets that appear publicly exposed due to Principal '*' policies or AllUsers ACL grants, but are actually neutralized by Block Public Access settings or scoped by conditions. This skill solves the calibration problem: distinguishing genuinely live exposure from neutralized lookalikes, and identifying the single critical needle hidden among many deceptive-clean buckets.

Core Features & Use Cases

• Effective Exposure Resolution: Composes four configuration layers per bucket—Block Public Access booleans, bucket policy, bucket ACL, and access points—to resolve the true effective verdict, never relying on a single layer.
• Needle Detection: In estates of 8-12 buckets, identifies the one genuinely live exposure (public policy, cross-account grant, or public ACL) buried among neutralized or scoped siblings.
• Symmetric Discipline: Correctly handles BPA neutralization (public grants blocked, cross-account grants survive) and condition scoping (Principal '*' narrowed by org ID, ExternalId, SourceIp, or access-point delegation is not public).
• Use Case: An SRE performing an incident response review or pre-deployment audit needs to confirm whether an S3 fleet is truly clean or harbors a quiet exposure, without drowning in false positives from intentionally scoped sharing.

Quick Start

Use the s3-estate-calibration-auditor skill to review the attached S3 estate configuration files and report whether any bucket is genuinely publicly or cross-account exposed.