[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6F3NMBSCQ1EAA9QKHC2DB13":3,"skill-same:01M6F3NMBSCQ1EAA9QKHC2DB13":74},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":40,"linkOnly":41,"markdownContent":42,"markdownBody":43,"frontMatter":44,"refName":29,"commitSha":54,"skillDirectory":55,"forksCount":56,"repositoryHtmlUrl":57,"repositoryHomepageUrl":6,"ownerHtmlUrl":58,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":59,"install":60,"resources":73},"01M6F3NMBSCQ1EAA9QKHC2DB13","aws-s3",null,"Configure S3 buckets, policies, and lifecycle rules. Implement versioning, replication, and security. Use when managing object storage on AWS.","boisenoise\u002Fskills-collections","boisenoise","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F193180?v=4","01M6CDBDQK6BDN55ZMA6B6PKBM","01M6CDBDVSJ3JPTBYN26FZ7TZK",13,"MIT","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-aws-s3\u002FSKILL.md",[],[18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39],"s3","aws","aws s3","agent-skills","when","object storage","relevant","helper","replication","critical","platform","main","community","implement","only","use","Rules","configure","access","lifecycle","devops-security","license","2026-11-10 10:12:30",false,"---\nname: aws-s3\ndescription: Configure S3 buckets, policies, and lifecycle rules. Implement versioning,\n  replication, and security. Use when managing object storage on AWS.\ncategory: devops\nrisk: critical\nsource: https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills\nsource_repo: BagelHole\u002FDevOps-Security-Agent-Skills\nsource_type: community\ndate_added: '2026-09-20'\nlicense: MIT\nlicense_source: https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills\u002Fblob\u002Fmain\u002FLICENSE\ncompatibility: Requires the relevant OS\u002Fplatform tooling and privileged access where\n  noted. Docs-only; helper scripts and templates not bundled.\nmetadata:\n  author: devops-skills\n  version: '1.0'\n---\n\n# AWS S3\n\nManage Amazon S3 object storage with production-grade security, lifecycle policies, replication, and access controls.\n\n## When to Use This Skill\n\n- Creating S3 buckets with security hardening (encryption, public access block, versioning)\n- Writing bucket policies to enforce HTTPS, restrict IP ranges, or grant cross-account access\n- Setting up lifecycle rules to transition objects between storage classes\n- Configuring cross-region replication for disaster recovery\n- Generating presigned URLs for temporary access to private objects\n- Setting up static website hosting or CloudFront origins\n- Troubleshooting access denied errors or policy conflicts\n\n## Prerequisites\n\n- AWS CLI v2 installed and configured\n- Least-privilege IAM permissions for the selected bucket\u002Fobject operations; grant only the required KMS actions for SSE-KMS. Do not grant wildcard service permissions as a default.\n- For replication: IAM role with replication permissions and destination bucket in target region\n- For logging: a separate logging bucket with appropriate ACL\n\n## Create and Secure a Bucket\n\n```bash\n# Create a bucket (us-east-1 does not need LocationConstraint)\naws s3api create-bucket \\\n  --bucket my-app-data-prod \\\n  --region us-east-1\n\n# Create a bucket in another region\naws s3api create-bucket \\\n  --bucket my-app-data-dr \\\n  --region us-west-2 \\\n  --create-bucket-configuration LocationConstraint=us-west-2\n\n# Block ALL public access (always do this first)\naws s3api put-public-access-block \\\n  --bucket my-app-data-prod \\\n  --public-access-block-configuration '{\n    \"BlockPublicAcls\": true,\n    \"IgnorePublicAcls\": true,\n    \"BlockPublicPolicy\": true,\n    \"RestrictPublicBuckets\": true\n  }'\n\n# Enable versioning\naws s3api put-bucket-versioning \\\n  --bucket my-app-data-prod \\\n  --versioning-configuration Status=Enabled\n\n# Enable server-side encryption with SSE-KMS\naws s3api put-bucket-encryption \\\n  --bucket my-app-data-prod \\\n  --server-side-encryption-configuration '{\n    \"Rules\": [{\n      \"ApplyServerSideEncryptionByDefault\": {\n        \"SSEAlgorithm\": \"aws:kms\",\n        \"KMSMasterKeyID\": \"alias\u002Fs3-key\"\n      },\n      \"BucketKeyEnabled\": true\n    }]\n  }'\n\n# Enable access logging\naws s3api put-bucket-logging \\\n  --bucket my-app-data-prod \\\n  --bucket-logging-status '{\n    \"LoggingEnabled\": {\n      \"TargetBucket\": \"my-access-logs-bucket\",\n      \"TargetPrefix\": \"s3-logs\u002Fmy-app-data-prod\u002F\"\n    }\n  }'\n\n# Add tags\naws s3api put-bucket-tagging \\\n  --bucket my-app-data-prod \\\n  --tagging '{\n    \"TagSet\": [\n      {\"Key\": \"Environment\", \"Value\": \"production\"},\n      {\"Key\": \"Team\", \"Value\": \"platform\"},\n      {\"Key\": \"DataClassification\", \"Value\": \"confidential\"}\n    ]\n  }'\n```\n\n## Bucket Policies\n\n```bash\n# Apply a bucket policy (enforce HTTPS and restrict to VPC endpoint)\naws s3api put-bucket-policy \\\n  --bucket my-app-data-prod \\\n  --policy '{\n    \"Version\": \"2012-10-17\",\n    \"Statement\": [\n      {\n        \"Sid\": \"DenyInsecureTransport\",\n        \"Effect\": \"Deny\",\n        \"Principal\": \"*\",\n        \"Action\": \"s3:*\",\n        \"Resource\": [\n          \"arn:aws:s3:::my-app-data-prod\",\n          \"arn:aws:s3:::my-app-data-prod\u002F*\"\n        ],\n        \"Condition\": {\n          \"Bool\": {\"aws:SecureTransport\": \"false\"}\n        }\n      },\n      {\n        \"Sid\": \"RestrictToVPCEndpoint\",\n        \"Effect\": \"Deny\",\n        \"Principal\": \"*\",\n        \"Action\": \"s3:*\",\n        \"Resource\": [\n          \"arn:aws:s3:::my-app-data-prod\",\n          \"arn:aws:s3:::my-app-data-prod\u002F*\"\n        ],\n        \"Condition\": {\n          \"StringNotEquals\": {\n            \"aws:sourceVpce\": \"vpce-abc123\"\n          }\n        }\n      }\n    ]\n  }'\n```\n\nCross-account access policy:\n\n```json\n{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Sid\": \"CrossAccountRead\",\n      \"Effect\": \"Allow\",\n      \"Principal\": {\n        \"AWS\": \"arn:aws:iam::987654321098:role\u002FDataAnalystRole\"\n      },\n      \"Action\": [\n        \"s3:GetObject\",\n        \"s3:ListBucket\"\n      ],\n      \"Resource\": [\n        \"arn:aws:s3:::my-app-data-prod\",\n        \"arn:aws:s3:::my-app-data-prod\u002Fshared\u002F*\"\n      ]\n    }\n  ]\n}\n```\n\n## Lifecycle Rules\n\n```bash\n# Apply a comprehensive lifecycle configuration\naws s3api put-bucket-lifecycle-configuration \\\n  --bucket my-app-data-prod \\\n  --lifecycle-configuration '{\n    \"Rules\": [\n      {\n        \"ID\": \"TierDownOldData\",\n        \"Status\": \"Enabled\",\n        \"Filter\": {\"Prefix\": \"data\u002F\"},\n        \"Transitions\": [\n          {\"Days\": 30, \"StorageClass\": \"STANDARD_IA\"},\n          {\"Days\": 90, \"StorageClass\": \"GLACIER_IR\"},\n          {\"Days\": 180, \"StorageClass\": \"GLACIER\"},\n          {\"Days\": 365, \"StorageClass\": \"DEEP_ARCHIVE\"}\n        ]\n      },\n      {\n        \"ID\": \"ExpireLogs\",\n        \"Status\": \"Enabled\",\n        \"Filter\": {\"Prefix\": \"logs\u002F\"},\n        \"Expiration\": {\"Days\": 90},\n        \"Transitions\": [\n          {\"Days\": 7, \"StorageClass\": \"STANDARD_IA\"},\n          {\"Days\": 30, \"StorageClass\": \"GLACIER\"}\n        ]\n      },\n      {\n        \"ID\": \"CleanupOldVersions\",\n        \"Status\": \"Enabled\",\n        \"Filter\": {\"Prefix\": \"\"},\n        \"NoncurrentVersionTransitions\": [\n          {\"NoncurrentDays\": 30, \"StorageClass\": \"STANDARD_IA\"},\n          {\"NoncurrentDays\": 90, \"StorageClass\": \"GLACIER\"}\n        ],\n        \"NoncurrentVersionExpiration\": {\"NoncurrentDays\": 180}\n      },\n      {\n        \"ID\": \"AbortIncompleteUploads\",\n        \"Status\": \"Enabled\",\n        \"Filter\": {\"Prefix\": \"\"},\n        \"AbortIncompleteMultipartUpload\": {\"DaysAfterInitiation\": 7}\n      },\n      {\n        \"ID\": \"ExpireDeleteMarkers\",\n        \"Status\": \"Enabled\",\n        \"Filter\": {\"Prefix\": \"\"},\n        \"Expiration\": {\"ExpiredObjectDeleteMarker\": true}\n      }\n    ]\n  }'\n```\n\n## Cross-Region Replication\n\n```bash\n# Enable replication (requires versioning on both buckets)\naws s3api put-bucket-replication \\\n  --bucket my-app-data-prod \\\n  --replication-configuration '{\n    \"Role\": \"arn:aws:iam::123456789012:role\u002FS3ReplicationRole\",\n    \"Rules\": [\n      {\n        \"ID\": \"ReplicateAll\",\n        \"Status\": \"Enabled\",\n        \"Priority\": 1,\n        \"Filter\": {\"Prefix\": \"\"},\n        \"Destination\": {\n          \"Bucket\": \"arn:aws:s3:::my-app-data-dr\",\n          \"StorageClass\": \"STANDARD_IA\",\n          \"EncryptionConfiguration\": {\n            \"ReplicaKmsKeyID\": \"arn:aws:kms:us-west-2:123456789012:key\u002Fdr-key-id\"\n          },\n          \"Metrics\": {\"Status\": \"Enabled\", \"EventThreshold\": {\"Minutes\": 15}},\n          \"ReplicationTime\": {\"Status\": \"Enabled\", \"Time\": {\"Minutes\": 15}}\n        },\n        \"DeleteMarkerReplication\": {\"Status\": \"Enabled\"},\n        \"SourceSelectionCriteria\": {\n          \"SseKmsEncryptedObjects\": {\"Status\": \"Enabled\"}\n        }\n      }\n    ]\n  }'\n\n# Check replication status\naws s3api head-object \\\n  --bucket my-app-data-prod \\\n  --key data\u002Fimportant-file.json \\\n  --query \"ReplicationStatus\"\n```\n\n## Presigned URLs\n\n```bash\n# Generate a presigned URL for downloading (valid 1 hour)\naws s3 presign s3:\u002F\u002Fmy-app-data-prod\u002Freports\u002Fquarterly.pdf \\\n  --expires-in 3600\n\n# Upload signing requires an SDK configured for PutObject, not `aws s3 presign`.\n# See the SDK procedure linked below; no s3api generate-presigned-url command exists.\n```\n\nThe [AWS CLI presign command](https:\u002F\u002Fdocs.aws.amazon.com\u002Fcli\u002Flatest\u002Freference\u002Fs3\u002Fpresign.html) signs GET requests. For PUT uploads, use the installed SDK's documented presigner with PutObject, a bounded expiry and the required content headers. Treat signed URLs as bearer secrets and do not print or persist them unnecessarily.\n\n## Common S3 Operations\n\n```bash\n# Preview a sync first; --delete removes remote objects absent locally.\n# Use long cache lifetimes only for immutable, versioned assets.\naws s3 sync .\u002Fbuild s3:\u002F\u002Fmy-app-data-prod\u002Fstatic\u002F --dryrun\n\n# Apply only after reviewing the preview within authorized scope.\n# Do not set Content-Encoding: gzip unless source bytes are actually compressed.\n# Sync a local directory to S3\naws s3 sync .\u002Fbuild s3:\u002F\u002Fmy-app-data-prod\u002Fstatic\u002F \\\n  --delete \\\n  --exclude \"*.tmp\" \\\n  --cache-control \"max-age=31536000\"\n\n# Copy with storage class\naws s3 cp large-archive.tar.gz s3:\u002F\u002Fmy-app-data-prod\u002Farchives\u002F \\\n  --storage-class GLACIER_IR\n\n# List objects with size summary\naws s3 ls s3:\u002F\u002Fmy-app-data-prod\u002F --recursive --summarize --human-readable\n\n# Remove all objects with a prefix\naws s3 rm s3:\u002F\u002Fmy-app-data-prod\u002Ftemp\u002F --recursive\n\n# Get bucket size via CloudWatch (most efficient for large buckets)\naws cloudwatch get-metric-statistics \\\n  --namespace AWS\u002FS3 \\\n  --metric-name BucketSizeBytes \\\n  --dimensions Name=BucketName,Value=my-app-data-prod Name=StorageType,Value=StandardStorage \\\n  --start-time \"$(date -u -d '2 days ago' +%Y-%m-%dT%H:%M:%SZ)\" \\\n  --end-time \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\" \\\n  --period 86400 \\\n  --statistics Average \\\n  --output table\n```\n\n## Terraform S3 Bucket\n\n```hcl\nresource \"aws_s3_bucket\" \"main\" {\n  bucket = \"my-app-data-prod\"\n\n  tags = {\n    Environment        = \"production\"\n    DataClassification = \"confidential\"\n  }\n}\n\nresource \"aws_s3_bucket_versioning\" \"main\" {\n  bucket = aws_s3_bucket.main.id\n  versioning_configuration {\n    status = \"Enabled\"\n  }\n}\n\nresource \"aws_s3_bucket_public_access_block\" \"main\" {\n  bucket = aws_s3_bucket.main.id\n\n  block_public_acls       = true\n  block_public_policy     = true\n  ignore_public_acls      = true\n  restrict_public_buckets = true\n}\n\nresource \"aws_s3_bucket_server_side_encryption_configuration\" \"main\" {\n  bucket = aws_s3_bucket.main.id\n\n  rule {\n    apply_server_side_encryption_by_default {\n      sse_algorithm     = \"aws:kms\"\n      kms_master_key_id = aws_kms_key.s3.arn\n    }\n    bucket_key_enabled = true\n  }\n}\n\nresource \"aws_s3_bucket_lifecycle_configuration\" \"main\" {\n  bucket = aws_s3_bucket.main.id\n\n  rule {\n    id     = \"tier-down\"\n    status = \"Enabled\"\n\n    transition {\n      days          = 30\n      storage_class = \"STANDARD_IA\"\n    }\n\n    transition {\n      days          = 90\n      storage_class = \"GLACIER\"\n    }\n\n    noncurrent_version_transition {\n      noncurrent_days = 30\n      storage_class   = \"GLACIER\"\n    }\n\n    noncurrent_version_expiration {\n      noncurrent_days = 180\n    }\n\n    abort_incomplete_multipart_upload {\n      days_after_initiation = 7\n    }\n  }\n}\n\nresource \"aws_s3_bucket_policy\" \"enforce_https\" {\n  bucket = aws_s3_bucket.main.id\n\n  policy = jsonencode({\n    Version = \"2012-10-17\"\n    Statement = [{\n      Sid       = \"DenyInsecureTransport\"\n      Effect    = \"Deny\"\n      Principal = \"*\"\n      Action    = \"s3:*\"\n      Resource  = [\n        aws_s3_bucket.main.arn,\n        \"${aws_s3_bucket.main.arn}\u002F*\"\n      ]\n      Condition = {\n        Bool = { \"aws:SecureTransport\" = \"false\" }\n      }\n    }]\n  })\n}\n```\n\n## Troubleshooting\n\n| Problem | Cause | Fix |\n|---|---|---|\n| Access Denied on GetObject | Bucket policy or IAM denies access | Check bucket policy, IAM policy, and public access block |\n| Access Denied on PutObject | Missing encryption header when required | Add SSE header; check bucket policy encryption conditions |\n| 403 on presigned URL | URL expired or wrong region | Regenerate; ensure region matches bucket region |\n| Replication not working | Versioning disabled on source or dest | Enable versioning on both buckets |\n| Lifecycle not transitioning | Rule filter does not match objects | Verify prefix and tag filters; check rule status |\n| Bucket delete fails | Bucket not empty or has versioned objects | Inspect retained versions and retention requirements; emptying versions is destructive and needs explicit scope. Versioning can be suspended, not disabled |\n| Slow uploads for large files | Single-part upload | Use `aws s3 cp` (auto multipart) or set multipart threshold |\n| Cross-account access denied | Both bucket policy AND IAM policy needed | Grant in bucket policy and in caller's IAM policy |\n| Object Lock prevents deletion | Governance or compliance mode active | Respect retention; governance bypass needs separate authorization and required permission. Compliance retention cannot be bypassed |\n\n## Related Skills\n\n- aws-iam (`aws-iam`) - Bucket and object access policies\n- aws-vpc (`aws-vpc`) - VPC endpoints for private S3 access\n- aws-cost-optimization (`aws-cost-optimization`) - Storage class optimization\n- terraform-aws (`terraform-aws`) - IaC deployment for S3\n- cloudformation (`cloudformation`) - AWS-native S3 templates\n\n## Limitations\n\n- VPC-endpoint deny policies can lock out console\u002Fadmin access; verify the endpoint and a recovery path before applying. Policy, lifecycle and tagging PUTs replace existing configurations: inspect and preserve required entries.\n- Infrastructure commands can disrupt services: confirm target host\u002Fscope and have backups\u002Fsnapshots before mutating state.\n- Docs-only import: upstream scripts and templates not bundled.\n\n","# AWS S3\n\nManage Amazon S3 object storage with production-grade security, lifecycle policies, replication, and access controls.\n\n## When to Use This Skill\n\n- Creating S3 buckets with security hardening (encryption, public access block, versioning)\n- Writing bucket policies to enforce HTTPS, restrict IP ranges, or grant cross-account access\n- Setting up lifecycle rules to transition objects between storage classes\n- Configuring cross-region replication for disaster recovery\n- Generating presigned URLs for temporary access to private objects\n- Setting up static website hosting or CloudFront origins\n- Troubleshooting access denied errors or policy conflicts\n\n## Prerequisites\n\n- AWS CLI v2 installed and configured\n- Least-privilege IAM permissions for the selected bucket\u002Fobject operations; grant only the required KMS actions for SSE-KMS. Do not grant wildcard service permissions as a default.\n- For replication: IAM role with replication permissions and destination bucket in target region\n- For logging: a separate logging bucket with appropriate ACL\n\n## Create and Secure a Bucket\n\n```bash\n# Create a bucket (us-east-1 does not need LocationConstraint)\naws s3api create-bucket \\\n  --bucket my-app-data-prod \\\n  --region us-east-1\n\n# Create a bucket in another region\naws s3api create-bucket \\\n  --bucket my-app-data-dr \\\n  --region us-west-2 \\\n  --create-bucket-configuration LocationConstraint=us-west-2\n\n# Block ALL public access (always do this first)\naws s3api put-public-access-block \\\n  --bucket my-app-data-prod \\\n  --public-access-block-configuration '{\n    \"BlockPublicAcls\": true,\n    \"IgnorePublicAcls\": true,\n    \"BlockPublicPolicy\": true,\n    \"RestrictPublicBuckets\": true\n  }'\n\n# Enable versioning\naws s3api put-bucket-versioning \\\n  --bucket my-app-data-prod \\\n  --versioning-configuration Status=Enabled\n\n# Enable server-side encryption with SSE-KMS\naws s3api put-bucket-encryption \\\n  --bucket my-app-data-prod \\\n  --server-side-encryption-configuration '{\n    \"Rules\": [{\n      \"ApplyServerSideEncryptionByDefault\": {\n        \"SSEAlgorithm\": \"aws:kms\",\n        \"KMSMasterKeyID\": \"alias\u002Fs3-key\"\n      },\n      \"BucketKeyEnabled\": true\n    }]\n  }'\n\n# Enable access logging\naws s3api put-bucket-logging \\\n  --bucket my-app-data-prod \\\n  --bucket-logging-status '{\n    \"LoggingEnabled\": {\n      \"TargetBucket\": \"my-access-logs-bucket\",\n      \"TargetPrefix\": \"s3-logs\u002Fmy-app-data-prod\u002F\"\n    }\n  }'\n\n# Add tags\naws s3api put-bucket-tagging \\\n  --bucket my-app-data-prod \\\n  --tagging '{\n    \"TagSet\": [\n      {\"Key\": \"Environment\", \"Value\": \"production\"},\n      {\"Key\": \"Team\", \"Value\": \"platform\"},\n      {\"Key\": \"DataClassification\", \"Value\": \"confidential\"}\n    ]\n  }'\n```\n\n## Bucket Policies\n\n```bash\n# Apply a bucket policy (enforce HTTPS and restrict to VPC endpoint)\naws s3api put-bucket-policy \\\n  --bucket my-app-data-prod \\\n  --policy '{\n    \"Version\": \"2012-10-17\",\n    \"Statement\": [\n      {\n        \"Sid\": \"DenyInsecureTransport\",\n        \"Effect\": \"Deny\",\n        \"Principal\": \"*\",\n        \"Action\": \"s3:*\",\n        \"Resource\": [\n          \"arn:aws:s3:::my-app-data-prod\",\n          \"arn:aws:s3:::my-app-data-prod\u002F*\"\n        ],\n        \"Condition\": {\n          \"Bool\": {\"aws:SecureTransport\": \"false\"}\n        }\n      },\n      {\n        \"Sid\": \"RestrictToVPCEndpoint\",\n        \"Effect\": \"Deny\",\n        \"Principal\": \"*\",\n        \"Action\": \"s3:*\",\n        \"Resource\": [\n          \"arn:aws:s3:::my-app-data-prod\",\n          \"arn:aws:s3:::my-app-data-prod\u002F*\"\n        ],\n        \"Condition\": {\n          \"StringNotEquals\": {\n            \"aws:sourceVpce\": \"vpce-abc123\"\n          }\n        }\n      }\n    ]\n  }'\n```\n\nCross-account access policy:\n\n```json\n{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Sid\": \"CrossAccountRead\",\n      \"Effect\": \"Allow\",\n      \"Principal\": {\n        \"AWS\": \"arn:aws:iam::987654321098:role\u002FDataAnalystRole\"\n      },\n      \"Action\": [\n        \"s3:GetObject\",\n        \"s3:ListBucket\"\n      ],\n      \"Resource\": [\n        \"arn:aws:s3:::my-app-data-prod\",\n        \"arn:aws:s3:::my-app-data-prod\u002Fshared\u002F*\"\n      ]\n    }\n  ]\n}\n```\n\n## Lifecycle Rules\n\n```bash\n# Apply a comprehensive lifecycle configuration\naws s3api put-bucket-lifecycle-configuration \\\n  --bucket my-app-data-prod \\\n  --lifecycle-configuration '{\n    \"Rules\": [\n      {\n        \"ID\": \"TierDownOldData\",\n        \"Status\": \"Enabled\",\n        \"Filter\": {\"Prefix\": \"data\u002F\"},\n        \"Transitions\": [\n          {\"Days\": 30, \"StorageClass\": \"STANDARD_IA\"},\n          {\"Days\": 90, \"StorageClass\": \"GLACIER_IR\"},\n          {\"Days\": 180, \"StorageClass\": \"GLACIER\"},\n          {\"Days\": 365, \"StorageClass\": \"DEEP_ARCHIVE\"}\n        ]\n      },\n      {\n        \"ID\": \"ExpireLogs\",\n        \"Status\": \"Enabled\",\n        \"Filter\": {\"Prefix\": \"logs\u002F\"},\n        \"Expiration\": {\"Days\": 90},\n        \"Transitions\": [\n          {\"Days\": 7, \"StorageClass\": \"STANDARD_IA\"},\n          {\"Days\": 30, \"StorageClass\": \"GLACIER\"}\n        ]\n      },\n      {\n        \"ID\": \"CleanupOldVersions\",\n        \"Status\": \"Enabled\",\n        \"Filter\": {\"Prefix\": \"\"},\n        \"NoncurrentVersionTransitions\": [\n          {\"NoncurrentDays\": 30, \"StorageClass\": \"STANDARD_IA\"},\n          {\"NoncurrentDays\": 90, \"StorageClass\": \"GLACIER\"}\n        ],\n        \"NoncurrentVersionExpiration\": {\"NoncurrentDays\": 180}\n      },\n      {\n        \"ID\": \"AbortIncompleteUploads\",\n        \"Status\": \"Enabled\",\n        \"Filter\": {\"Prefix\": \"\"},\n        \"AbortIncompleteMultipartUpload\": {\"DaysAfterInitiation\": 7}\n      },\n      {\n        \"ID\": \"ExpireDeleteMarkers\",\n        \"Status\": \"Enabled\",\n        \"Filter\": {\"Prefix\": \"\"},\n        \"Expiration\": {\"ExpiredObjectDeleteMarker\": true}\n      }\n    ]\n  }'\n```\n\n## Cross-Region Replication\n\n```bash\n# Enable replication (requires versioning on both buckets)\naws s3api put-bucket-replication \\\n  --bucket my-app-data-prod \\\n  --replication-configuration '{\n    \"Role\": \"arn:aws:iam::123456789012:role\u002FS3ReplicationRole\",\n    \"Rules\": [\n      {\n        \"ID\": \"ReplicateAll\",\n        \"Status\": \"Enabled\",\n        \"Priority\": 1,\n        \"Filter\": {\"Prefix\": \"\"},\n        \"Destination\": {\n          \"Bucket\": \"arn:aws:s3:::my-app-data-dr\",\n          \"StorageClass\": \"STANDARD_IA\",\n          \"EncryptionConfiguration\": {\n            \"ReplicaKmsKeyID\": \"arn:aws:kms:us-west-2:123456789012:key\u002Fdr-key-id\"\n          },\n          \"Metrics\": {\"Status\": \"Enabled\", \"EventThreshold\": {\"Minutes\": 15}},\n          \"ReplicationTime\": {\"Status\": \"Enabled\", \"Time\": {\"Minutes\": 15}}\n        },\n        \"DeleteMarkerReplication\": {\"Status\": \"Enabled\"},\n        \"SourceSelectionCriteria\": {\n          \"SseKmsEncryptedObjects\": {\"Status\": \"Enabled\"}\n        }\n      }\n    ]\n  }'\n\n# Check replication status\naws s3api head-object \\\n  --bucket my-app-data-prod \\\n  --key data\u002Fimportant-file.json \\\n  --query \"ReplicationStatus\"\n```\n\n## Presigned URLs\n\n```bash\n# Generate a presigned URL for downloading (valid 1 hour)\naws s3 presign s3:\u002F\u002Fmy-app-data-prod\u002Freports\u002Fquarterly.pdf \\\n  --expires-in 3600\n\n# Upload signing requires an SDK configured for PutObject, not `aws s3 presign`.\n# See the SDK procedure linked below; no s3api generate-presigned-url command exists.\n```\n\nThe [AWS CLI presign command](https:\u002F\u002Fdocs.aws.amazon.com\u002Fcli\u002Flatest\u002Freference\u002Fs3\u002Fpresign.html) signs GET requests. For PUT uploads, use the installed SDK's documented presigner with PutObject, a bounded expiry and the required content headers. Treat signed URLs as bearer secrets and do not print or persist them unnecessarily.\n\n## Common S3 Operations\n\n```bash\n# Preview a sync first; --delete removes remote objects absent locally.\n# Use long cache lifetimes only for immutable, versioned assets.\naws s3 sync .\u002Fbuild s3:\u002F\u002Fmy-app-data-prod\u002Fstatic\u002F --dryrun\n\n# Apply only after reviewing the preview within authorized scope.\n# Do not set Content-Encoding: gzip unless source bytes are actually compressed.\n# Sync a local directory to S3\naws s3 sync .\u002Fbuild s3:\u002F\u002Fmy-app-data-prod\u002Fstatic\u002F \\\n  --delete \\\n  --exclude \"*.tmp\" \\\n  --cache-control \"max-age=31536000\"\n\n# Copy with storage class\naws s3 cp large-archive.tar.gz s3:\u002F\u002Fmy-app-data-prod\u002Farchives\u002F \\\n  --storage-class GLACIER_IR\n\n# List objects with size summary\naws s3 ls s3:\u002F\u002Fmy-app-data-prod\u002F --recursive --summarize --human-readable\n\n# Remove all objects with a prefix\naws s3 rm s3:\u002F\u002Fmy-app-data-prod\u002Ftemp\u002F --recursive\n\n# Get bucket size via CloudWatch (most efficient for large buckets)\naws cloudwatch get-metric-statistics \\\n  --namespace AWS\u002FS3 \\\n  --metric-name BucketSizeBytes \\\n  --dimensions Name=BucketName,Value=my-app-data-prod Name=StorageType,Value=StandardStorage \\\n  --start-time \"$(date -u -d '2 days ago' +%Y-%m-%dT%H:%M:%SZ)\" \\\n  --end-time \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\" \\\n  --period 86400 \\\n  --statistics Average \\\n  --output table\n```\n\n## Terraform S3 Bucket\n\n```hcl\nresource \"aws_s3_bucket\" \"main\" {\n  bucket = \"my-app-data-prod\"\n\n  tags = {\n    Environment        = \"production\"\n    DataClassification = \"confidential\"\n  }\n}\n\nresource \"aws_s3_bucket_versioning\" \"main\" {\n  bucket = aws_s3_bucket.main.id\n  versioning_configuration {\n    status = \"Enabled\"\n  }\n}\n\nresource \"aws_s3_bucket_public_access_block\" \"main\" {\n  bucket = aws_s3_bucket.main.id\n\n  block_public_acls       = true\n  block_public_policy     = true\n  ignore_public_acls      = true\n  restrict_public_buckets = true\n}\n\nresource \"aws_s3_bucket_server_side_encryption_configuration\" \"main\" {\n  bucket = aws_s3_bucket.main.id\n\n  rule {\n    apply_server_side_encryption_by_default {\n      sse_algorithm     = \"aws:kms\"\n      kms_master_key_id = aws_kms_key.s3.arn\n    }\n    bucket_key_enabled = true\n  }\n}\n\nresource \"aws_s3_bucket_lifecycle_configuration\" \"main\" {\n  bucket = aws_s3_bucket.main.id\n\n  rule {\n    id     = \"tier-down\"\n    status = \"Enabled\"\n\n    transition {\n      days          = 30\n      storage_class = \"STANDARD_IA\"\n    }\n\n    transition {\n      days          = 90\n      storage_class = \"GLACIER\"\n    }\n\n    noncurrent_version_transition {\n      noncurrent_days = 30\n      storage_class   = \"GLACIER\"\n    }\n\n    noncurrent_version_expiration {\n      noncurrent_days = 180\n    }\n\n    abort_incomplete_multipart_upload {\n      days_after_initiation = 7\n    }\n  }\n}\n\nresource \"aws_s3_bucket_policy\" \"enforce_https\" {\n  bucket = aws_s3_bucket.main.id\n\n  policy = jsonencode({\n    Version = \"2012-10-17\"\n    Statement = [{\n      Sid       = \"DenyInsecureTransport\"\n      Effect    = \"Deny\"\n      Principal = \"*\"\n      Action    = \"s3:*\"\n      Resource  = [\n        aws_s3_bucket.main.arn,\n        \"${aws_s3_bucket.main.arn}\u002F*\"\n      ]\n      Condition = {\n        Bool = { \"aws:SecureTransport\" = \"false\" }\n      }\n    }]\n  })\n}\n```\n\n## Troubleshooting\n\n| Problem | Cause | Fix |\n|---|---|---|\n| Access Denied on GetObject | Bucket policy or IAM denies access | Check bucket policy, IAM policy, and public access block |\n| Access Denied on PutObject | Missing encryption header when required | Add SSE header; check bucket policy encryption conditions |\n| 403 on presigned URL | URL expired or wrong region | Regenerate; ensure region matches bucket region |\n| Replication not working | Versioning disabled on source or dest | Enable versioning on both buckets |\n| Lifecycle not transitioning | Rule filter does not match objects | Verify prefix and tag filters; check rule status |\n| Bucket delete fails | Bucket not empty or has versioned objects | Inspect retained versions and retention requirements; emptying versions is destructive and needs explicit scope. Versioning can be suspended, not disabled |\n| Slow uploads for large files | Single-part upload | Use `aws s3 cp` (auto multipart) or set multipart threshold |\n| Cross-account access denied | Both bucket policy AND IAM policy needed | Grant in bucket policy and in caller's IAM policy |\n| Object Lock prevents deletion | Governance or compliance mode active | Respect retention; governance bypass needs separate authorization and required permission. Compliance retention cannot be bypassed |\n\n## Related Skills\n\n- aws-iam (`aws-iam`) - Bucket and object access policies\n- aws-vpc (`aws-vpc`) - VPC endpoints for private S3 access\n- aws-cost-optimization (`aws-cost-optimization`) - Storage class optimization\n- terraform-aws (`terraform-aws`) - IaC deployment for S3\n- cloudformation (`cloudformation`) - AWS-native S3 templates\n\n## Limitations\n\n- VPC-endpoint deny policies can lock out console\u002Fadmin access; verify the endpoint and a recovery path before applying. Policy, lifecycle and tagging PUTs replace existing configurations: inspect and preserve required entries.\n- Infrastructure commands can disrupt services: confirm target host\u002Fscope and have backups\u002Fsnapshots before mutating state.\n- Docs-only import: upstream scripts and templates not bundled.\n\n",{"name":5,"risk":27,"source":45,"license":14,"category":46,"metadata":47,"date_added":50,"description":7,"source_repo":51,"source_type":30,"compatibility":52,"license_source":53},"https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills","devops",{"author":48,"version":49},"devops-skills","1.0","2026-09-20","BagelHole\u002FDevOps-Security-Agent-Skills","Requires the relevant OS\u002Fplatform tooling and privileged access where noted. Docs-only; helper scripts and templates not bundled.","https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills\u002Fblob\u002Fmain\u002FLICENSE","7bf2279c8a65758319526a721d5c4b75683aec9c","skills\u002Fantigravity-aws-s3",3,"https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections","https:\u002F\u002Fgithub.com\u002Fboisenoise","2026-11-14 14:18:11",{"source":8,"skillName":5,"commands":61,"prompt":71,"zipAvailable":72},[62,65,68],{"tool":63,"command":64},"npx","npx skills add boisenoise\u002Fskills-collections --skill aws-s3",{"tool":66,"command":67},"bunx","bunx skills add boisenoise\u002Fskills-collections --skill aws-s3",{"tool":69,"command":70},"pnpm","pnpm dlx skills add boisenoise\u002Fskills-collections --skill aws-s3","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-aws-s3\u002FSKILL.md",true,[],[75,100,126,152,171,194],{"skillNo":76,"name":77,"nameZh":6,"description":78,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":79,"licenseFileUrl":80,"sourceHtmlUrl":81,"categories":82,"keywords":83,"publishedAt":40},"01M6WNH92BHVFXHGPDZCPJ0AG0","web-access","Use Treg for public web or platform data only when existing search, browser and connected tools cannot cover the task, with explicit cost and data boundaries.","Apache-2.0","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-web-access\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-web-access\u002FSKILL.md",[],[84,36,85,86,87,88,89,90,91,92,93,32,94,95,28,27,96,97,98,22,99],"web","web access","official","development","browser","search","data","Tools","read","fetch","youtube","free tools","free","cover","normal","2026",{"skillNo":101,"name":102,"nameZh":6,"description":103,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":79,"licenseFileUrl":104,"sourceHtmlUrl":105,"categories":106,"keywords":112,"publishedAt":40},"01M6WNF9XAYAB2CZDDJBAKNM93","treg","Use the Treg CLI or MCP catalog to discover, price and call authorized external tools with team-scoped credentials and a user-approved budget.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-treg\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-treg\u002FSKILL.md",[107],{"categoryNo":108,"categoryName":109,"taxonomyType":110,"taxonomyTypeDesc":111},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[102,113,114,115,86,87,39,91,116,117,118,119,33,120,121,27,122,123,124,125,99],"MCP","cli","github","Budget","credentials","team","catalog","call","discover","external tools","with","scoped","blob",{"skillNo":127,"name":128,"nameZh":6,"description":129,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":79,"licenseFileUrl":130,"sourceHtmlUrl":131,"categories":132,"keywords":138,"publishedAt":40},"01M6WN93MEAZ4E41DYAHJRPHQT","recruit","Turn a job description into an evidence-linked candidate shortlist through Treg, with job-related ranking and optional authorized business contact enrichment.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-recruit\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-recruit\u002FSKILL.md",[133],{"categoryNo":134,"categoryName":135,"taxonomyType":136,"taxonomyTypeDesc":137},"01JBSEEDCAT000000000000038","人力资源","PROFESSION","适用职业",[128,115,86,39,139,140,141,142,143,144,27,145,146,147,123,148,149,150,151,125,102,99],"https","email","enrichment","business","evidence","phone","ranking","post","job description","for","person","candidate","reason",{"skillNo":153,"name":154,"nameZh":6,"description":155,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":79,"licenseFileUrl":156,"sourceHtmlUrl":157,"categories":158,"keywords":159,"publishedAt":40},"01M6WN8R5RXSMHM9B4D9FAFX42","rea-growth","Analyze a company’s public growth and content through Treg, distinguish observations from hypotheses, and produce an evidence-linked playbook within an approved budget.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-rea-growth\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-rea-growth\u002FSKILL.md",[],[160,161,162,115,86,39,163,164,139,165,116,166,167,168,143,27,169,170,125,102,99],"growth","rea","rea growth","produce","content","playbook","marketing","analyze","public","observations","company",{"skillNo":172,"name":173,"nameZh":6,"description":174,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":79,"licenseFileUrl":175,"sourceHtmlUrl":176,"categories":177,"keywords":178,"publishedAt":40},"01M6WN2EVE3RQRGWAKBT4S7YT2","make-ugc","Create original AI UGC-style product videos through Treg: research hooks, approve a licensed presenter and voice, generate clips, add captions and report costs.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-make-ugc\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-make-ugc\u002FSKILL.md",[],[179,180,115,181,86,182,39,183,184,185,186,187,27,188,189,190,191,192,193,125],"make","make ugc","research","create","Video","Captions","ads","short","hooks","head","style","niche","trending","talking-head","approve",{"skillNo":195,"name":196,"nameZh":6,"description":197,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":79,"licenseFileUrl":198,"sourceHtmlUrl":199,"categories":200,"keywords":201,"publishedAt":40},"01M6WN10ARAA63Y8K1YNGXJ2RM","lead-signals","Find and qualify public buying signals through Treg, rank fitting business accounts and optionally enrich authorized business contact information.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-lead-signals\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-lead-signals\u002FSKILL.md",[],[202,203,204,115,86,39,205,206,142,207,208,27,209,210,211,212,213,214,215,125],"signals","lead","lead signals","how","find","ready","as","how to","qualify","people","information","enrich","changes","funding"]