Skills Explorer Add Skills

querying-aws-s3

An agent skill by aws, from aws/agent-toolkit-for-aws. Tags: analytics, athena, aws, s3, sql.

What it does

Queries S3 object metadata, tracks bucket activity, audits object changes, searches annotations, and analyzes storage metrics using S3 Metadata system tables (journal, inventory, annotation) and S3 Storage Lens tables via Athena SQL. Applies when counting objects, finding recent uploads or deletions, identifying who wrote to a prefix, breaking down storage classes, finding objects by tag, searching annotation content, analyzing storage lens metrics, or enabling S3 Metadata tracking. Prefers system tables over raw S3 APIs (list-objects-v2, head-object) at scale. Trigger phrases: bucket activity, object count, who uploaded, track deletions, storage class breakdown, find by tag, search annotations, storage lens metrics, audit bucket changes.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add aws/agent-toolkit-for-aws --skill querying-aws-s3

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/aws/agent-toolkit-for-aws
cp -r agent-toolkit-for-aws/skills/specialized-skills/system-table-skills/querying-aws-s3 ~/.claude/skills/querying-aws-s3

Safety box score

Grade C, moderate risk: 42 of 100 risk points, rated 2026-10-19. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill queries AWS S3 Metadata and Storage Lens via Athena, and it can also enable metadata tracking, Storage Lens export, and Glue federated catalog registration. The main risks are cloud-side configuration changes and exposure of sensitive audit fields like requester IDs and source IP addresses.

Category levels, from 0 (none) to 3 (high)
CategoryLevelWhy
Code & shell execution2 (moderate)It expects the agent to run AWS CLI commands and Athena SQL such as `aws s3api get-bucket-metadata-configuration` and `aws glue create-catalog`; there is no shipped script, but it does execute shell commands against AWS.
Network access2 (moderate)All useful actions talk to remote AWS services (`s3api`, `s3control`, `glue`, Athena SQL), so bucket metadata and query results are sent over the network to AWS endpoints.
Filesystem reach0 (none)The skill does not read, write, or delete local files or dotfiles; it only references AWS resources and CLI commands.
Secrets & credentials2 (moderate)It explicitly queries fields that can reveal sensitive operational data, including `requester` and `source_ip_address` in the journal table.
Privilege & persistence2 (moderate)It requires AWS permissions to configure S3 Metadata, Storage Lens, and Glue federation, and it warns that Athena workgroup encryption must be configured.
Instruction hijack surface0 (none)There is no instruction to ignore system rules, hide actions, or follow external content; the text is procedural AWS guidance.
Irreversible actions2 (moderate)It can change AWS-side configuration by running `create-bucket-metadata-configuration`, `put-storage-lens-configuration`, and `create-catalog`, which alter bucket/account setup without editing local files.
Transparency0 (none)The only file is plain markdown; there are no binaries, minified assets, or decoded-at-runtime code.

Before installing

Rated 2026-10-19 by an automated review of 1 file from the skill's repository.

Source

Repository
aws/agent-toolkit-for-aws (all skills from this repository)
Path
skills/specialized-skills/system-table-skills/querying-aws-s3/SKILL.md
Branch
main
Updated
2026-09-19