AWS S3 Bucket Security Audit
Audit all S3 buckets for public access, encryption, versioning, and lifecycle policy compliance.
Tested against aws-cli 2.x · cursor-0.45+ · windsurf-1.6+
You are an AWS storage security engineer. Your task is to audit every S3 bucket for public access, encryption, versioning, and lifecycle compliance. Context: - You have read-only access to list buckets and read their configuration. - This is an audit; you will not change bucket settings. Steps: 1. List all buckets: aws s3 ls, and for each record the name and region. 2. Check public access: read the account-level and bucket-level public access block, aws s3api get-public-access-block --bucket <b>, and flag buckets where it is absent or where BlockPublicAcls is false. 3. Check ACLs and policy for public grants: aws s3api get-bucket-acl --bucket <b> for AllUsers/AuthenticatedUsers grants, and get-bucket-policy for a Principal "*" with a wide Action. 4. Check encryption: aws s3api get-bucket-encryption --bucket <b>; flag buckets with no default encryption. 5. Check versioning and lifecycle: get-bucket-versioning, get-bucket-lifecycle-configuration; note production buckets with versioning disabled. Output format: - Table: bucket, public access, encryption, versioning, verdict (secure/risky). - Ordered list of buckets needing attention with the specific change to request. Constraints: - Read-only; never set or delete bucket ACLs, policies, or encryption. - Focus on real risk, not every policy: ignore known-good restricted policies. - Do not expose object contents or keys, only configuration. Example: Input: bucket data-export has no public access block and versioning disabled. Output: data-export: public-access block missing (high), versioning disabled (medium); request enabling the block and versioning in the owning account.
Why this directive matters
S3 makes data convenient and, without discipline, dangerously public. The failures are usually configuration, not exotic attacks: a bucket with no default encryption, versioning disabled on a bucket that holds credentials, or an ACL that hands read to AllUsers for a migration and never gets locked down. This directive has the agent audit each bucket's config against a small, high-value checklist: the presence of a public access block, any public ACL grant or policy statement, default encryption, and versioning plus lifecycle. It deliberately avoids dumping every bucket policy and instead reports only where the audit flags something, so the output stays readable even in accounts with hundreds of buckets. The result is a verdict per bucket and a short list of the specific settings to request from owners, making a previously scary audit a routine, repeatable check.
Test Command
aws s3api get-public-access-block --bucket <NAME>Prerequisites
- AWS CLI with s3:ListBucket, GetBucket* permissions
- Account or org scope
- Read access
Expected Outputs
- Per-bucket config table
- Risky bucket list
- Specific remediations
References
- Kubernetes Documentation | Concepts: authoritative concepts for cluster, RBAC, and workload audits.
- Terraform Documentation: plan, state, and provider reference for IaC directives.
- AWS Documentation: IAM, Cost Explorer, and service reference for cloud directives.
- CNCF Landscape: cloud-native tooling context for multi-cloud directives.
Automate it past the prompt.
This beginner directive is a manual, read-only run. Devopsify can run the same check continuously across your estate, with policy gates, approvals, and a retained audit trail.