skills.rest
mreferre
mreferreCOMMUNITY
Explore all skills by this author →
Website𝕏@mreferreGitHub

securing-s3-buckets

Audit and harden S3 buckets for access control, encryption, and monitoring.

Updated May 12, 2026
Search Tags:#encryption#s3#cloudtrail#guardduty#bucket security#iam access analyzer#aws config
One-click install
npx skills add https://github.com/mreferre/aws-agent-toolkit-skills --skill securing-s3-buckets-mreferre
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: securing-s3-buckets
Source: https://github.com/mreferre/aws-agent-toolkit-skills/tree/main/.kiro/skills/securing-s3-buckets
Command: npx skills add https://github.com/mreferre/aws-agent-toolkit-skills --skill securing-s3-buckets-mreferre

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

It prevents S3 buckets from being left misconfigured by guiding creation, auditing, and remediation of access control, encryption, monitoring, and policy hardening using AWS best practices.

Core Features & Use Cases

  • Secure new S3 buckets (Workflow A): Sets versioning, default encryption (SSE-S3 with bucket keys and SSE-C blocked by default), logging, enforces HTTPS-only with a Deny policy, and enables ABAC.
  • Audit existing S3 buckets (Workflow B): Runs read-only checks and reports PASS/FAIL/NOT CONFIGURED with severity for public access, HTTPS enforcement, encryption posture, logging, GuardDuty coverage, and more.
  • Remediate findings (Workflow C): Applies targeted fixes by issue type and re-runs the relevant audit checks to confirm resolution.
  • Configure encryption (Workflow D): Supports SSE-S3 defaults and customer-managed SSE-KMS with least-privilege guidance while enforcing SSE-C blocking and bucket key settings.
  • Enable monitoring (Workflow E): Activates GuardDuty detectors safely and enables core AWS Config rules (plus optional ones) for compliance visibility.

Quick Start

Use the securing-s3-buckets skill to audit and harden the S3 bucket "my-bucket-123" in region "us-east-1" against public access, HTTPS enforcement, encryption, logging, GuardDuty, and AWS Config controls.

Frequently Asked Questions about securing-s3-buckets

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit S3 bucket security configurations for public exposure and weak encryption?▼

Auditing S3 bucket security involves running read-only checks that report PASS, FAIL, or NOT CONFIGURED with severity levels for public access, HTTPS enforcement, encryption posture, logging, and GuardDuty coverage.

What is the best way to harden a new S3 bucket with default encryption and HTTPS enforcement?▼

Hardening a new S3 bucket requires setting versioning, default SSE-S3 encryption with bucket keys, logging, enforcing HTTPS-only traffic via a Deny policy, and enabling ABAC access controls.

How do I remediate S3 bucket security findings after an audit?▼

Remediate S3 bucket security findings by applying targeted fixes based on the specific issue type, then re-running the relevant audit checks to confirm the security posture has been resolved.

Can I use SSE-KMS customer-managed keys for S3 bucket encryption while blocking SSE-C?▼

S3 encryption configuration supports SSE-S3 defaults and customer-managed SSE-KMS with least-privilege guidance, while enforcing SSE-C blocking and specific bucket key settings for compliance.

Does S3 bucket monitoring require GuardDuty and AWS Config rules?▼

S3 bucket monitoring requires safely activating GuardDuty detectors and enabling core AWS Config rules, plus optional ones, to provide operational monitoring and compliance visibility.

Do I need IAM Access Analyzer and CloudTrail to secure S3 buckets properly?▼

Securing S3 buckets properly requires IAM Access Analyzer for permission validation and region-correct CloudTrail handling to maintain operational guardrails and policy safety.

Related Skills

Explore More Legal & Compliance Skills→
dgethingsdgethings

aws-security-audit

Inspect IAM users, roles, policies, and CloudTrail events across AWS accounts.

Community
Advanced
devCharuzudevCharuzu

cloud-security

Analyze AWS, Azure, and GCP cloud configurations for misconfigurations and exposure risks.

Community
Intermediate
Renzo-TognellaRenzo-Tognella

securing-aws-iam-permissions

Automate AWS IAM hardening with least privilege, MFA, and credential rotation.

Community
Advanced
pluginagentmarketplacepluginagentmarketplace
2

aws-s3-management

Automate secure S3 bucket creation with encryption, access logging, and policy enforcement.

Community
Advanced