skills.rest
sakicodes
sakicodesCOMMUNITY
Explore all skills by this author →
GitHub

securing-s3-buckets

Create, audit, and remediate S3 bucket security configurations using AWS CLI commands.

Updated Jul 1, 2026
Search Tags:#security#aws#audit#remediation#encryption#s3#cloudtrail
One-click install
npx skills add https://github.com/sakicodes/BuildFestHackathon26 --skill securing-s3-buckets-sakicodes
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: securing-s3-buckets
Source: https://github.com/sakicodes/BuildFestHackathon26/tree/main/.agents/skills/securing-s3-buckets
Command: npx skills add https://github.com/sakicodes/BuildFestHackathon26 --skill securing-s3-buckets-sakicodes

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? S3 buckets are frequently misconfigured with public access, missing encryption, or no logging, leading to data exposure and compliance failures. This Skill guides an AI agent through AWS best-practice workflows to secure new buckets, audit existing ones, and remediate findings safely. ## Core Features & Use Cases - Five Security Workflows: Secure new buckets (versioning, SSE-S3 encryption, HTTPS enforcement, ABAC), audit existing buckets against a severity-ranked checklist, remediate specific findings, configure encryption (SSE-S3 or customer-managed KMS), and enable monitoring via GuardDuty, CloudTrail, and AWS Config rules. - Safe Policy Management: Enforces backup-and-merge rules for put-bucket-policy so existing policy statements are never silently overwritten. - Use Case: A security engineer asks the agent to audit a production bucket. The agent runs read-only checks for Block Public Access, encryption, versioning, logging, and GuardDuty, then reports each control as PASS, FAIL, or NOT CONFIGURED with severity, and offers remediation commands for failures. ## Quick Start Ask the agent to audit the security configuration of your S3 bucket named 'my-app-data' in us-east-1 and report any findings.

Frequently Asked Questions about securing-s3-buckets

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I secure a new S3 bucket following AWS best practices?▼

Create the bucket in the account-regional namespace, enable versioning, apply SSE-S3 default encryption with Bucket Keys and SSE-C blocked, enable access logging, enforce HTTPS with a DenyInsecureTransport bucket policy, and enable ABAC. Block Public Access and disabled ACLs are already S3 defaults and should not be changed.

How to audit an existing S3 bucket for security misconfigurations?▼

Run read-only checks with get-public-access-block, get-bucket-policy, get-bucket-encryption, get-bucket-versioning, get-bucket-logging, and GuardDuty and Access Analyzer queries. Report each control as PASS, FAIL, or NOT CONFIGURED with a severity rating from Critical to Low.

Should I use SSE-S3 or SSE-KMS for S3 bucket encryption?▼

SSE-S3 is the recommended default for most buckets. Use SSE-KMS only when you need key policy control or cross-account sharing, and always use a customer managed key specified by full ARN, never the AWS managed aws/s3 key or an alias.

Why does put-bucket-policy remove my existing S3 policy statements?▼

The put-bucket-policy API replaces the entire bucket policy rather than merging. Always retrieve the existing policy with get-bucket-policy first, back it up, merge new statements into the existing Statement array, and validate the JSON before applying.

What is the difference between S3 server access logging and CloudTrail data events?▼

S3 server access logging has no per-request charge but lacks IAM principal attribution and real-time alerting. CloudTrail data events charge per event but provide full IAM principal identity, log anonymous and AccessDenied requests, and integrate with EventBridge for alerting.

Why do CloudTrail S3 data event changes not take effect?▼

CloudTrail event selector commands must run in the trail's home region, not the bucket's region. Find the correct region with aws cloudtrail describe-trails and pass it via the --region flag to put-event-selectors.

Related Skills

Explore More Software Engineering Skills→
hoodinihoodini
262

aws-account-management

Automate AWS account, organization, IAM, and billing management.

Community
Advanced
jaskaranhundaljaskaranhundal
3

findings-tracker

Manage security finding lifecycles with risk scores and SLA enforcement.

Community
Advanced
awsaws
2.5k

setup-security-agent

Configure AWS Security Agent workspace with agent space, IAM role, and S3 bucket.

Official
Advanced
ChatAndBuildChatAndBuild
1

DevOps IaC Engineer

Automate Terraform, Pulumi, and CloudFormation workflows with policy and drift control.

Official
Advanced