securing-s3-buckets

An agent skill by aws, from aws/agent-toolkit-for-aws. Tags: aws, compliance, monitoring, s3, security.

What it does

Create and secure S3 buckets following AWS best practices for access control, encryption, monitoring, and remediation of misconfigurations. Use when the user wants to secure a new bucket, audit an existing bucket, fix a security finding, configure encryption, or enable logging and monitoring. Do NOT use for general S3 data operations, S3 Tables setup, or discovering existing data assets.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add aws/agent-toolkit-for-aws --skill securing-s3-buckets

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/aws/agent-toolkit-for-aws
cp -r agent-toolkit-for-aws/skills/specialized-skills/storage-skills/securing-s3-buckets ~/.claude/skills/securing-s3-buckets

Safety box score

Grade C, moderate risk: 33 of 100 risk points, rated 2026-10-19. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill runs AWS CLI/MCP commands to create, audit, and remediate S3 security settings, and it can also enable CloudTrail, GuardDuty, and AWS Config. The main blast radius is cloud-side writes: bucket policies, encryption, logging, and even recursive re-copying of objects for re-encryption; it also writes a few local backup/policy files.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	2 (moderate)	It explicitly runs AWS CLI/MCP commands and shell helpers such as `python3 -m json.tool` and multiple `aws ...` write operations.
Network access	2 (moderate)	It sends requests to AWS services for S3, KMS, CloudTrail, GuardDuty, Config, and Access Analyzer.
Filesystem reach	1 (low)	It writes local files like `backup-policy-$(date +%s).json` and `key-policy.json` in the working directory.
Secrets & credentials	1 (low)	It uses the operator's configured AWS credentials and tells the agent to verify them with `aws sts get-caller-identity`.
Privilege & persistence	0 (none)	No sudo, global installs, services, or shell-startup changes are requested.
Instruction hijack surface	0 (none)	No instructions to ignore safeguards, fetch remote prompts, or hide behavior were found.
Irreversible actions	3 (high)	It can create buckets, alter policies/encryption/logging, enable monitoring, and recursively rewrite objects; those are impactful write actions.
Transparency	0 (none)	All files are plain markdown; no binaries, minified blobs, or downloaded code are present.

Before installing

Read `references/workflows.md` and `references/remediation.md`, especially the policy-merge and recursive copy steps.
Test it first in a non-production AWS account/profile and confirm `aws sts get-caller-identity` returns the intended principal.
If you may use KMS, review `references/encryption.md` and prepare a customer-managed key ARN plus key policy before running it.

Rated 2026-10-19 by an automated review of 6 files from the skill's repository.

Source

Repository: aws/agent-toolkit-for-aws (all skills from this repository)
Path: skills/specialized-skills/storage-skills/securing-s3-buckets/SKILL.md
Branch: main
Updated: 2026-09-19

aws-security — Covers AWS security services and workflows — Security Hub V2 (OCSF) findings, connectors, aggregators, automation rules, and security posture summaries.
aws-cleanrooms — Troubleshoots and debugs AWS Clean Rooms collaboration issues related to IAM roles, S3 bucket policies, KMS keys, Lake Formation permissions.
creating-api-gateway-stage — Creates an API Gateway stage with CloudWatch logging, X-Ray tracing, throttling, WAF integration, and IAM roles following AWS best practices.
creating-secrets-using-best-practices — Creates and manages secrets in AWS Secrets Manager following security best practices.
setting-up-cloudtrail-multi-region — Enables a multi-region AWS CloudTrail trail with S3 log storage, CloudWatch Logs integration.
aws-iam — Provides verified corrections for IAM behaviors that AI agents frequently get wrong — policy evaluation edge cases, trust policy gotchas, STS session limits.