Securing S3 Buckets

This one walks you through the full S3 security checklist: creating buckets with default-deny policies, auditing existing configurations against AWS best practices, and fixing specific findings like missing encryption or public access. It enforces some opinionated constraints (customer-managed KMS keys only, mandatory HTTPS-only policies, bucket key enablement) and includes safety rails around put-bucket-policy so you don't accidentally wipe existing statements. The audit workflow checks versioning, encryption, logging, public access blocks, and Object Lock, then reports each as pass/fail with severity. It's detailed enough that you could hand it to someone unfamiliar with S3 security and they'd get a properly locked-down bucket, but experienced users might find the guardrails restrictive.

skills.sh installs: 7.4K
GitHub stars: 3.4K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add aws/agent-toolkit-for-aws --skill securing-s3-buckets --agent claude-code

Installs into .claude/skills of the current project.

Files

Overview

Implements layered S3 security controls across five workflows: securing new buckets, auditing existing configurations, remediating findings, configuring encryption, and enabling monitoring. Follows AWS Well-Architected security best practices.

Execute commands using the AWS MCP server when connected (sandboxed execution, audit logging, observability). Fall back to AWS CLI or shell otherwise.

Common Tasks

0. Verify Dependencies

Check for required tools before starting.

Constraints:

You MUST inform the user if required tools are missing
You SHOULD confirm credentials with aws sts get-caller-identity

See references/iam-permissions.md for IAM permissions by workflow.

1. Classify the Request

User intent	Workflow
Secure a new bucket	A: Secure New Bucket
Audit / review existing bucket	B: Audit Existing Bucket
Fix a specific finding	C: Remediate Issue
Configure encryption	D: Configure Encryption
Enable logging / monitoring	E: Enable Monitoring

Constraints:

SKILL.md on GitHub