Securing S3 Buckets

Overview

Implements layered S3 security controls across five workflows: securing new buckets, auditing existing configurations, remediating findings, configuring encryption, and enabling monitoring. Follows AWS Well-Architected security best practices.

Execute commands using the AWS MCP server when connected (sandboxed execution, audit logging, observability). Fall back to AWS CLI or shell otherwise.

Common Tasks

0. Verify Dependencies

Check for required tools before starting.

Constraints:

• You MUST inform the user if required tools are missing
• You SHOULD confirm credentials with aws sts get-caller-identity

See references/iam-permissions.md for IAM permissions by workflow.

1. Classify the Request

Constraints:

• You MUST ask for all required parameters upfront
• You MUST confirm bucket name and region before any write operation
• You MAY infer region from user context if clearly stated
• You SHOULD run aws iam simulate-principal-policy to validate permissions before write operations
• You SHOULD display write commands and wait for confirmation before executing

put-bucket-policy Safety Rules

These rules apply to ALL workflows that call put-bucket-policy:

• You MUST attempt to retrieve the existing policy first (aws s3api get-bucket-policy) — put-bucket-policy replaces the entire policy
• If a policy exists, you MUST back it up before modifying: aws s3api get-bucket-policy --bucket <name> --output text > backup-policy-$(date +%s).json
• If NoSuchBucketPolicy is returned, proceed with a new policy — no backup is needed
• You MUST merge new statements into the existing policy's Statement array (if one exists)
• You MUST validate merged JSON syntax before applying (e.g. echo '<policy>' | python3 -m json.tool)
• You SHOULD display the full put-bucket-policy command and wait for confirmation

2. Workflow A — Secure New Bucket

See references/workflows.md for full CLI steps.

Required steps (execute in order, do not skip):

1. Create bucket with --bucket-namespace account-regional
2. Enable versioning
3. Enable encryption (SSE-S3 + Bucket Keys + block SSE-C)
4. Enable logging (ask user which option — conditional)
5. Enforce HTTPS-only via DenyInsecureTransport bucket policy
6. Enable ABAC

Constraints:

• You MUST pass --bucket-namespace account-regional on create-bucket call — this is REQUIRED, not optional. Example:

  aws s3api create-bucket --bucket <name> --bucket-namespace account-regional --region <region>

• You MUST NOT change Block Public Access — S3 enables it by default on new buckets

• You MUST NOT change ACL ownership controls — S3 disables ACLs (BucketOwnerEnforced) by default

• You MUST apply a bucket policy with a DenyInsecureTransport statement that denies s3:* when aws:SecureTransport is false — this is REQUIRED, not optional. Example:

  aws s3api put-bucket-policy --bucket <name> --policy '{"Version":"2012-10-17","Statement":[{"Sid":"DenyInsecureTransport","Effect":"Deny","Principal":"*","Action":"s3:*","Resource":["arn:aws:s3:::<name>/*","arn:aws:s3:::<name>"],"Condition":{"Bool":{"aws:SecureTransport":"false"}}}]}'

• You MUST ask the user which logging option they want before step 4

• You MUST follow the put-bucket-policy safety rules for steps 4 and 5

• You SHOULD confirm each step succeeded before proceeding

3. Workflow B — Audit Existing Bucket

See references/audit-checklist.md for the full checklist.

Constraints:

• You MUST run all read-only audit commands before reporting findings
• You MUST NOT execute any write or modify commands during an audit
• You MUST report each control as PASS / FAIL / NOT CONFIGURED with severity
• For logging: report PASS if either S3 server access logging OR CloudTrail data events are enabled; NOT CONFIGURED only if neither