[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6NW7441P2J83K95FHBFSGZR":3,"skill-same:01M6NW7441P2J83K95FHBFSGZR":71},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":38,"linkOnly":39,"markdownContent":40,"markdownBody":41,"frontMatter":42,"refName":28,"commitSha":52,"skillDirectory":53,"forksCount":13,"repositoryHtmlUrl":54,"repositoryHomepageUrl":6,"ownerHtmlUrl":55,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":56,"install":57,"resources":70},"01M6NW7441P2J83K95FHBFSGZR","aws-s3",null,"Configure S3 buckets, policies, and lifecycle rules. Implement versioning, replication, and security. Use when managing object storage on AWS.","duc-duy-1612\u002FOnline-Delivery-Systems-Web","duc-duy-1612","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F192231384?v=4","01M6NSDKQQDKVTHZ8DZMZ1VYY6","01M6NSDKW8DDVTQHBT1HBDDJPT",0,"MIT","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Faws-s3\u002FSKILL.md",[],[18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37],"s3","aws","aws s3","object storage","license","relevant","helper","replication","critical","platform","main","community","agent-skills","only","use","Rules","configure","access","lifecycle","devops-security","2026-11-10 10:12:30",false,"---\nname: aws-s3\ndescription: Configure S3 buckets, policies, and lifecycle rules. Implement versioning,\n  replication, and security. Use when managing object storage on AWS.\ncategory: devops\nrisk: critical\nsource: https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills\nsource_repo: BagelHole\u002FDevOps-Security-Agent-Skills\nsource_type: community\ndate_added: '2026-09-20'\nlicense: MIT\nlicense_source: https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills\u002Fblob\u002Fmain\u002FLICENSE\ncompatibility: Requires the relevant OS\u002Fplatform tooling and privileged access where\n  noted. Docs-only; helper scripts and templates not bundled.\nmetadata:\n  author: devops-skills\n  version: '1.0'\n---\n\n# AWS S3\n\nManage Amazon S3 object storage with production-grade security, lifecycle policies, replication, and access controls.\n\n## When to Use This Skill\n\n- Creating S3 buckets with security hardening (encryption, public access block, versioning)\n- Writing bucket policies to enforce HTTPS, restrict IP ranges, or grant cross-account access\n- Setting up lifecycle rules to transition objects between storage classes\n- Configuring cross-region replication for disaster recovery\n- Generating presigned URLs for temporary access to private objects\n- Setting up static website hosting or CloudFront origins\n- Troubleshooting access denied errors or policy conflicts\n\n## Prerequisites\n\n- AWS CLI v2 installed and configured\n- IAM permissions: `s3:*`, `s3-object-lambda:*`, `kms:*` (for SSE-KMS)\n- For replication: IAM role with replication permissions and destination bucket in target region\n- For logging: a separate logging bucket with appropriate ACL\n\n## Create and Secure a Bucket\n\n```bash\n# Create a bucket (us-east-1 does not need LocationConstraint)\naws s3api create-bucket \\\n  --bucket my-app-data-prod \\\n  --region us-east-1\n\n# Create a bucket in another region\naws s3api create-bucket \\\n  --bucket my-app-data-dr \\\n  --region us-west-2 \\\n  --create-bucket-configuration LocationConstraint=us-west-2\n\n# Block ALL public access (always do this first)\naws s3api put-public-access-block \\\n  --bucket my-app-data-prod \\\n  --public-access-block-configuration '{\n    \"BlockPublicAcls\": true,\n    \"IgnorePublicAcls\": true,\n    \"BlockPublicPolicy\": true,\n    \"RestrictPublicBuckets\": true\n  }'\n\n# Enable versioning\naws s3api put-bucket-versioning \\\n  --bucket my-app-data-prod \\\n  --versioning-configuration Status=Enabled\n\n# Enable server-side encryption with SSE-KMS\naws s3api put-bucket-encryption \\\n  --bucket my-app-data-prod \\\n  --server-side-encryption-configuration '{\n    \"Rules\": [{\n      \"ApplyServerSideEncryptionByDefault\": {\n        \"SSEAlgorithm\": \"aws:kms\",\n        \"KMSMasterKeyID\": \"alias\u002Fs3-key\"\n      },\n      \"BucketKeyEnabled\": true\n    }]\n  }'\n\n# Enable access logging\naws s3api put-bucket-logging \\\n  --bucket my-app-data-prod \\\n  --bucket-logging-status '{\n    \"LoggingEnabled\": {\n      \"TargetBucket\": \"my-access-logs-bucket\",\n      \"TargetPrefix\": \"s3-logs\u002Fmy-app-data-prod\u002F\"\n    }\n  }'\n\n# Add tags\naws s3api put-bucket-tagging \\\n  --bucket my-app-data-prod \\\n  --tagging '{\n    \"TagSet\": [\n      {\"Key\": \"Environment\", \"Value\": \"production\"},\n      {\"Key\": \"Team\", \"Value\": \"platform\"},\n      {\"Key\": \"DataClassification\", \"Value\": \"confidential\"}\n    ]\n  }'\n```\n\n## Bucket Policies\n\n```bash\n# Apply a bucket policy (enforce HTTPS and restrict to VPC endpoint)\naws s3api put-bucket-policy \\\n  --bucket my-app-data-prod \\\n  --policy '{\n    \"Version\": \"2012-10-17\",\n    \"Statement\": [\n      {\n        \"Sid\": \"DenyInsecureTransport\",\n        \"Effect\": \"Deny\",\n        \"Principal\": \"*\",\n        \"Action\": \"s3:*\",\n        \"Resource\": [\n          \"arn:aws:s3:::my-app-data-prod\",\n          \"arn:aws:s3:::my-app-data-prod\u002F*\"\n        ],\n        \"Condition\": {\n          \"Bool\": {\"aws:SecureTransport\": \"false\"}\n        }\n      },\n      {\n        \"Sid\": \"RestrictToVPCEndpoint\",\n        \"Effect\": \"Deny\",\n        \"Principal\": \"*\",\n        \"Action\": \"s3:*\",\n        \"Resource\": [\n          \"arn:aws:s3:::my-app-data-prod\",\n          \"arn:aws:s3:::my-app-data-prod\u002F*\"\n        ],\n        \"Condition\": {\n          \"StringNotEquals\": {\n            \"aws:sourceVpce\": \"vpce-abc123\"\n          }\n        }\n      }\n    ]\n  }'\n```\n\nCross-account access policy:\n\n```json\n{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Sid\": \"CrossAccountRead\",\n      \"Effect\": \"Allow\",\n      \"Principal\": {\n        \"AWS\": \"arn:aws:iam::987654321098:role\u002FDataAnalystRole\"\n      },\n      \"Action\": [\n        \"s3:GetObject\",\n        \"s3:ListBucket\"\n      ],\n      \"Resource\": [\n        \"arn:aws:s3:::my-app-data-prod\",\n        \"arn:aws:s3:::my-app-data-prod\u002Fshared\u002F*\"\n      ]\n    }\n  ]\n}\n```\n\n## Lifecycle Rules\n\n```bash\n# Apply a comprehensive lifecycle configuration\naws s3api put-bucket-lifecycle-configuration \\\n  --bucket my-app-data-prod \\\n  --lifecycle-configuration '{\n    \"Rules\": [\n      {\n        \"ID\": \"TierDownOldData\",\n        \"Status\": \"Enabled\",\n        \"Filter\": {\"Prefix\": \"data\u002F\"},\n        \"Transitions\": [\n          {\"Days\": 30, \"StorageClass\": \"STANDARD_IA\"},\n          {\"Days\": 90, \"StorageClass\": \"GLACIER_IR\"},\n          {\"Days\": 180, \"StorageClass\": \"GLACIER\"},\n          {\"Days\": 365, \"StorageClass\": \"DEEP_ARCHIVE\"}\n        ]\n      },\n      {\n        \"ID\": \"ExpireLogs\",\n        \"Status\": \"Enabled\",\n        \"Filter\": {\"Prefix\": \"logs\u002F\"},\n        \"Expiration\": {\"Days\": 90},\n        \"Transitions\": [\n          {\"Days\": 7, \"StorageClass\": \"STANDARD_IA\"},\n          {\"Days\": 30, \"StorageClass\": \"GLACIER\"}\n        ]\n      },\n      {\n        \"ID\": \"CleanupOldVersions\",\n        \"Status\": \"Enabled\",\n        \"Filter\": {\"Prefix\": \"\"},\n        \"NoncurrentVersionTransitions\": [\n          {\"NoncurrentDays\": 30, \"StorageClass\": \"STANDARD_IA\"},\n          {\"NoncurrentDays\": 90, \"StorageClass\": \"GLACIER\"}\n        ],\n        \"NoncurrentVersionExpiration\": {\"NoncurrentDays\": 180}\n      },\n      {\n        \"ID\": \"AbortIncompleteUploads\",\n        \"Status\": \"Enabled\",\n        \"Filter\": {\"Prefix\": \"\"},\n        \"AbortIncompleteMultipartUpload\": {\"DaysAfterInitiation\": 7}\n      },\n      {\n        \"ID\": \"ExpireDeleteMarkers\",\n        \"Status\": \"Enabled\",\n        \"Filter\": {\"Prefix\": \"\"},\n        \"Expiration\": {\"ExpiredObjectDeleteMarker\": true}\n      }\n    ]\n  }'\n```\n\n## Cross-Region Replication\n\n```bash\n# Enable replication (requires versioning on both buckets)\naws s3api put-bucket-replication \\\n  --bucket my-app-data-prod \\\n  --replication-configuration '{\n    \"Role\": \"arn:aws:iam::123456789012:role\u002FS3ReplicationRole\",\n    \"Rules\": [\n      {\n        \"ID\": \"ReplicateAll\",\n        \"Status\": \"Enabled\",\n        \"Priority\": 1,\n        \"Filter\": {\"Prefix\": \"\"},\n        \"Destination\": {\n          \"Bucket\": \"arn:aws:s3:::my-app-data-dr\",\n          \"StorageClass\": \"STANDARD_IA\",\n          \"EncryptionConfiguration\": {\n            \"ReplicaKmsKeyID\": \"arn:aws:kms:us-west-2:123456789012:key\u002Fdr-key-id\"\n          },\n          \"Metrics\": {\"Status\": \"Enabled\", \"EventThreshold\": {\"Minutes\": 15}},\n          \"ReplicationTime\": {\"Status\": \"Enabled\", \"Time\": {\"Minutes\": 15}}\n        },\n        \"DeleteMarkerReplication\": {\"Status\": \"Enabled\"},\n        \"SourceSelectionCriteria\": {\n          \"SseKmsEncryptedObjects\": {\"Status\": \"Enabled\"}\n        }\n      }\n    ]\n  }'\n\n# Check replication status\naws s3api head-object \\\n  --bucket my-app-data-prod \\\n  --key data\u002Fimportant-file.json \\\n  --query \"ReplicationStatus\"\n```\n\n## Presigned URLs\n\n```bash\n# Generate a presigned URL for downloading (valid 1 hour)\naws s3 presign s3:\u002F\u002Fmy-app-data-prod\u002Freports\u002Fquarterly.pdf \\\n  --expires-in 3600\n\n# Generate a presigned URL for uploading\naws s3 presign s3:\u002F\u002Fmy-app-data-prod\u002Fuploads\u002Fuser-file.zip \\\n  --expires-in 3600\n\n# Presigned URL with specific content type (using the API directly)\naws s3api generate-presigned-url \\\n  --client-method put_object \\\n  --params '{\"Bucket\":\"my-app-data-prod\",\"Key\":\"uploads\u002Fphoto.jpg\",\"ContentType\":\"image\u002Fjpeg\"}' \\\n  --expires-in 3600\n```\n\n## Common S3 Operations\n\n```bash\n# Sync a local directory to S3\naws s3 sync .\u002Fbuild s3:\u002F\u002Fmy-app-data-prod\u002Fstatic\u002F \\\n  --delete \\\n  --exclude \"*.tmp\" \\\n  --cache-control \"max-age=31536000\" \\\n  --content-encoding \"gzip\"\n\n# Copy with storage class\naws s3 cp large-archive.tar.gz s3:\u002F\u002Fmy-app-data-prod\u002Farchives\u002F \\\n  --storage-class GLACIER_IR\n\n# List objects with size summary\naws s3 ls s3:\u002F\u002Fmy-app-data-prod\u002F --recursive --summarize --human-readable\n\n# Remove all objects with a prefix\naws s3 rm s3:\u002F\u002Fmy-app-data-prod\u002Ftemp\u002F --recursive\n\n# Get bucket size via CloudWatch (most efficient for large buckets)\naws cloudwatch get-metric-statistics \\\n  --namespace AWS\u002FS3 \\\n  --metric-name BucketSizeBytes \\\n  --dimensions Name=BucketName,Value=my-app-data-prod Name=StorageType,Value=StandardStorage \\\n  --start-time \"$(date -u -d '2 days ago' +%Y-%m-%dT%H:%M:%SZ)\" \\\n  --end-time \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\" \\\n  --period 86400 \\\n  --statistics Average \\\n  --output table\n```\n\n## Terraform S3 Bucket\n\n```hcl\nresource \"aws_s3_bucket\" \"main\" {\n  bucket = \"my-app-data-prod\"\n\n  tags = {\n    Environment        = \"production\"\n    DataClassification = \"confidential\"\n  }\n}\n\nresource \"aws_s3_bucket_versioning\" \"main\" {\n  bucket = aws_s3_bucket.main.id\n  versioning_configuration {\n    status = \"Enabled\"\n  }\n}\n\nresource \"aws_s3_bucket_public_access_block\" \"main\" {\n  bucket = aws_s3_bucket.main.id\n\n  block_public_acls       = true\n  block_public_policy     = true\n  ignore_public_acls      = true\n  restrict_public_buckets = true\n}\n\nresource \"aws_s3_bucket_server_side_encryption_configuration\" \"main\" {\n  bucket = aws_s3_bucket.main.id\n\n  rule {\n    apply_server_side_encryption_by_default {\n      sse_algorithm     = \"aws:kms\"\n      kms_master_key_id = aws_kms_key.s3.arn\n    }\n    bucket_key_enabled = true\n  }\n}\n\nresource \"aws_s3_bucket_lifecycle_configuration\" \"main\" {\n  bucket = aws_s3_bucket.main.id\n\n  rule {\n    id     = \"tier-down\"\n    status = \"Enabled\"\n\n    transition {\n      days          = 30\n      storage_class = \"STANDARD_IA\"\n    }\n\n    transition {\n      days          = 90\n      storage_class = \"GLACIER\"\n    }\n\n    noncurrent_version_transition {\n      noncurrent_days = 30\n      storage_class   = \"GLACIER\"\n    }\n\n    noncurrent_version_expiration {\n      noncurrent_days = 180\n    }\n\n    abort_incomplete_multipart_upload {\n      days_after_initiation = 7\n    }\n  }\n}\n\nresource \"aws_s3_bucket_policy\" \"enforce_https\" {\n  bucket = aws_s3_bucket.main.id\n\n  policy = jsonencode({\n    Version = \"2012-10-17\"\n    Statement = [{\n      Sid       = \"DenyInsecureTransport\"\n      Effect    = \"Deny\"\n      Principal = \"*\"\n      Action    = \"s3:*\"\n      Resource  = [\n        aws_s3_bucket.main.arn,\n        \"${aws_s3_bucket.main.arn}\u002F*\"\n      ]\n      Condition = {\n        Bool = { \"aws:SecureTransport\" = \"false\" }\n      }\n    }]\n  })\n}\n```\n\n## Troubleshooting\n\n| Problem | Cause | Fix |\n|---|---|---|\n| Access Denied on GetObject | Bucket policy or IAM denies access | Check bucket policy, IAM policy, and public access block |\n| Access Denied on PutObject | Missing encryption header when required | Add SSE header; check bucket policy encryption conditions |\n| 403 on presigned URL | URL expired or wrong region | Regenerate; ensure region matches bucket region |\n| Replication not working | Versioning disabled on source or dest | Enable versioning on both buckets |\n| Lifecycle not transitioning | Rule filter does not match objects | Verify prefix and tag filters; check rule status |\n| Bucket delete fails | Bucket not empty or has versioned objects | Delete all objects and versions first; disable versioning |\n| Slow uploads for large files | Single-part upload | Use `aws s3 cp` (auto multipart) or set multipart threshold |\n| Cross-account access denied | Both bucket policy AND IAM policy needed | Grant in bucket policy and in caller's IAM policy |\n| Object Lock prevents deletion | Governance or compliance mode active | Use governance bypass (with permission) or wait for retention |\n\n## Related Skills\n\n- aws-iam (`aws-iam`) - Bucket and object access policies\n- aws-vpc (`aws-vpc`) - VPC endpoints for private S3 access\n- aws-cost-optimization (`aws-cost-optimization`) - Storage class optimization\n- terraform-aws (`terraform-aws`) - IaC deployment for S3\n- cloudformation (`cloudformation`) - AWS-native S3 templates\n\n## Limitations\n\n- Infrastructure commands can disrupt services: confirm target host\u002Fscope and have backups\u002Fsnapshots before mutating state.\n- Docs-only import: upstream scripts and templates not bundled.\n\n","# AWS S3\n\nManage Amazon S3 object storage with production-grade security, lifecycle policies, replication, and access controls.\n\n## When to Use This Skill\n\n- Creating S3 buckets with security hardening (encryption, public access block, versioning)\n- Writing bucket policies to enforce HTTPS, restrict IP ranges, or grant cross-account access\n- Setting up lifecycle rules to transition objects between storage classes\n- Configuring cross-region replication for disaster recovery\n- Generating presigned URLs for temporary access to private objects\n- Setting up static website hosting or CloudFront origins\n- Troubleshooting access denied errors or policy conflicts\n\n## Prerequisites\n\n- AWS CLI v2 installed and configured\n- IAM permissions: `s3:*`, `s3-object-lambda:*`, `kms:*` (for SSE-KMS)\n- For replication: IAM role with replication permissions and destination bucket in target region\n- For logging: a separate logging bucket with appropriate ACL\n\n## Create and Secure a Bucket\n\n```bash\n# Create a bucket (us-east-1 does not need LocationConstraint)\naws s3api create-bucket \\\n  --bucket my-app-data-prod \\\n  --region us-east-1\n\n# Create a bucket in another region\naws s3api create-bucket \\\n  --bucket my-app-data-dr \\\n  --region us-west-2 \\\n  --create-bucket-configuration LocationConstraint=us-west-2\n\n# Block ALL public access (always do this first)\naws s3api put-public-access-block \\\n  --bucket my-app-data-prod \\\n  --public-access-block-configuration '{\n    \"BlockPublicAcls\": true,\n    \"IgnorePublicAcls\": true,\n    \"BlockPublicPolicy\": true,\n    \"RestrictPublicBuckets\": true\n  }'\n\n# Enable versioning\naws s3api put-bucket-versioning \\\n  --bucket my-app-data-prod \\\n  --versioning-configuration Status=Enabled\n\n# Enable server-side encryption with SSE-KMS\naws s3api put-bucket-encryption \\\n  --bucket my-app-data-prod \\\n  --server-side-encryption-configuration '{\n    \"Rules\": [{\n      \"ApplyServerSideEncryptionByDefault\": {\n        \"SSEAlgorithm\": \"aws:kms\",\n        \"KMSMasterKeyID\": \"alias\u002Fs3-key\"\n      },\n      \"BucketKeyEnabled\": true\n    }]\n  }'\n\n# Enable access logging\naws s3api put-bucket-logging \\\n  --bucket my-app-data-prod \\\n  --bucket-logging-status '{\n    \"LoggingEnabled\": {\n      \"TargetBucket\": \"my-access-logs-bucket\",\n      \"TargetPrefix\": \"s3-logs\u002Fmy-app-data-prod\u002F\"\n    }\n  }'\n\n# Add tags\naws s3api put-bucket-tagging \\\n  --bucket my-app-data-prod \\\n  --tagging '{\n    \"TagSet\": [\n      {\"Key\": \"Environment\", \"Value\": \"production\"},\n      {\"Key\": \"Team\", \"Value\": \"platform\"},\n      {\"Key\": \"DataClassification\", \"Value\": \"confidential\"}\n    ]\n  }'\n```\n\n## Bucket Policies\n\n```bash\n# Apply a bucket policy (enforce HTTPS and restrict to VPC endpoint)\naws s3api put-bucket-policy \\\n  --bucket my-app-data-prod \\\n  --policy '{\n    \"Version\": \"2012-10-17\",\n    \"Statement\": [\n      {\n        \"Sid\": \"DenyInsecureTransport\",\n        \"Effect\": \"Deny\",\n        \"Principal\": \"*\",\n        \"Action\": \"s3:*\",\n        \"Resource\": [\n          \"arn:aws:s3:::my-app-data-prod\",\n          \"arn:aws:s3:::my-app-data-prod\u002F*\"\n        ],\n        \"Condition\": {\n          \"Bool\": {\"aws:SecureTransport\": \"false\"}\n        }\n      },\n      {\n        \"Sid\": \"RestrictToVPCEndpoint\",\n        \"Effect\": \"Deny\",\n        \"Principal\": \"*\",\n        \"Action\": \"s3:*\",\n        \"Resource\": [\n          \"arn:aws:s3:::my-app-data-prod\",\n          \"arn:aws:s3:::my-app-data-prod\u002F*\"\n        ],\n        \"Condition\": {\n          \"StringNotEquals\": {\n            \"aws:sourceVpce\": \"vpce-abc123\"\n          }\n        }\n      }\n    ]\n  }'\n```\n\nCross-account access policy:\n\n```json\n{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Sid\": \"CrossAccountRead\",\n      \"Effect\": \"Allow\",\n      \"Principal\": {\n        \"AWS\": \"arn:aws:iam::987654321098:role\u002FDataAnalystRole\"\n      },\n      \"Action\": [\n        \"s3:GetObject\",\n        \"s3:ListBucket\"\n      ],\n      \"Resource\": [\n        \"arn:aws:s3:::my-app-data-prod\",\n        \"arn:aws:s3:::my-app-data-prod\u002Fshared\u002F*\"\n      ]\n    }\n  ]\n}\n```\n\n## Lifecycle Rules\n\n```bash\n# Apply a comprehensive lifecycle configuration\naws s3api put-bucket-lifecycle-configuration \\\n  --bucket my-app-data-prod \\\n  --lifecycle-configuration '{\n    \"Rules\": [\n      {\n        \"ID\": \"TierDownOldData\",\n        \"Status\": \"Enabled\",\n        \"Filter\": {\"Prefix\": \"data\u002F\"},\n        \"Transitions\": [\n          {\"Days\": 30, \"StorageClass\": \"STANDARD_IA\"},\n          {\"Days\": 90, \"StorageClass\": \"GLACIER_IR\"},\n          {\"Days\": 180, \"StorageClass\": \"GLACIER\"},\n          {\"Days\": 365, \"StorageClass\": \"DEEP_ARCHIVE\"}\n        ]\n      },\n      {\n        \"ID\": \"ExpireLogs\",\n        \"Status\": \"Enabled\",\n        \"Filter\": {\"Prefix\": \"logs\u002F\"},\n        \"Expiration\": {\"Days\": 90},\n        \"Transitions\": [\n          {\"Days\": 7, \"StorageClass\": \"STANDARD_IA\"},\n          {\"Days\": 30, \"StorageClass\": \"GLACIER\"}\n        ]\n      },\n      {\n        \"ID\": \"CleanupOldVersions\",\n        \"Status\": \"Enabled\",\n        \"Filter\": {\"Prefix\": \"\"},\n        \"NoncurrentVersionTransitions\": [\n          {\"NoncurrentDays\": 30, \"StorageClass\": \"STANDARD_IA\"},\n          {\"NoncurrentDays\": 90, \"StorageClass\": \"GLACIER\"}\n        ],\n        \"NoncurrentVersionExpiration\": {\"NoncurrentDays\": 180}\n      },\n      {\n        \"ID\": \"AbortIncompleteUploads\",\n        \"Status\": \"Enabled\",\n        \"Filter\": {\"Prefix\": \"\"},\n        \"AbortIncompleteMultipartUpload\": {\"DaysAfterInitiation\": 7}\n      },\n      {\n        \"ID\": \"ExpireDeleteMarkers\",\n        \"Status\": \"Enabled\",\n        \"Filter\": {\"Prefix\": \"\"},\n        \"Expiration\": {\"ExpiredObjectDeleteMarker\": true}\n      }\n    ]\n  }'\n```\n\n## Cross-Region Replication\n\n```bash\n# Enable replication (requires versioning on both buckets)\naws s3api put-bucket-replication \\\n  --bucket my-app-data-prod \\\n  --replication-configuration '{\n    \"Role\": \"arn:aws:iam::123456789012:role\u002FS3ReplicationRole\",\n    \"Rules\": [\n      {\n        \"ID\": \"ReplicateAll\",\n        \"Status\": \"Enabled\",\n        \"Priority\": 1,\n        \"Filter\": {\"Prefix\": \"\"},\n        \"Destination\": {\n          \"Bucket\": \"arn:aws:s3:::my-app-data-dr\",\n          \"StorageClass\": \"STANDARD_IA\",\n          \"EncryptionConfiguration\": {\n            \"ReplicaKmsKeyID\": \"arn:aws:kms:us-west-2:123456789012:key\u002Fdr-key-id\"\n          },\n          \"Metrics\": {\"Status\": \"Enabled\", \"EventThreshold\": {\"Minutes\": 15}},\n          \"ReplicationTime\": {\"Status\": \"Enabled\", \"Time\": {\"Minutes\": 15}}\n        },\n        \"DeleteMarkerReplication\": {\"Status\": \"Enabled\"},\n        \"SourceSelectionCriteria\": {\n          \"SseKmsEncryptedObjects\": {\"Status\": \"Enabled\"}\n        }\n      }\n    ]\n  }'\n\n# Check replication status\naws s3api head-object \\\n  --bucket my-app-data-prod \\\n  --key data\u002Fimportant-file.json \\\n  --query \"ReplicationStatus\"\n```\n\n## Presigned URLs\n\n```bash\n# Generate a presigned URL for downloading (valid 1 hour)\naws s3 presign s3:\u002F\u002Fmy-app-data-prod\u002Freports\u002Fquarterly.pdf \\\n  --expires-in 3600\n\n# Generate a presigned URL for uploading\naws s3 presign s3:\u002F\u002Fmy-app-data-prod\u002Fuploads\u002Fuser-file.zip \\\n  --expires-in 3600\n\n# Presigned URL with specific content type (using the API directly)\naws s3api generate-presigned-url \\\n  --client-method put_object \\\n  --params '{\"Bucket\":\"my-app-data-prod\",\"Key\":\"uploads\u002Fphoto.jpg\",\"ContentType\":\"image\u002Fjpeg\"}' \\\n  --expires-in 3600\n```\n\n## Common S3 Operations\n\n```bash\n# Sync a local directory to S3\naws s3 sync .\u002Fbuild s3:\u002F\u002Fmy-app-data-prod\u002Fstatic\u002F \\\n  --delete \\\n  --exclude \"*.tmp\" \\\n  --cache-control \"max-age=31536000\" \\\n  --content-encoding \"gzip\"\n\n# Copy with storage class\naws s3 cp large-archive.tar.gz s3:\u002F\u002Fmy-app-data-prod\u002Farchives\u002F \\\n  --storage-class GLACIER_IR\n\n# List objects with size summary\naws s3 ls s3:\u002F\u002Fmy-app-data-prod\u002F --recursive --summarize --human-readable\n\n# Remove all objects with a prefix\naws s3 rm s3:\u002F\u002Fmy-app-data-prod\u002Ftemp\u002F --recursive\n\n# Get bucket size via CloudWatch (most efficient for large buckets)\naws cloudwatch get-metric-statistics \\\n  --namespace AWS\u002FS3 \\\n  --metric-name BucketSizeBytes \\\n  --dimensions Name=BucketName,Value=my-app-data-prod Name=StorageType,Value=StandardStorage \\\n  --start-time \"$(date -u -d '2 days ago' +%Y-%m-%dT%H:%M:%SZ)\" \\\n  --end-time \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\" \\\n  --period 86400 \\\n  --statistics Average \\\n  --output table\n```\n\n## Terraform S3 Bucket\n\n```hcl\nresource \"aws_s3_bucket\" \"main\" {\n  bucket = \"my-app-data-prod\"\n\n  tags = {\n    Environment        = \"production\"\n    DataClassification = \"confidential\"\n  }\n}\n\nresource \"aws_s3_bucket_versioning\" \"main\" {\n  bucket = aws_s3_bucket.main.id\n  versioning_configuration {\n    status = \"Enabled\"\n  }\n}\n\nresource \"aws_s3_bucket_public_access_block\" \"main\" {\n  bucket = aws_s3_bucket.main.id\n\n  block_public_acls       = true\n  block_public_policy     = true\n  ignore_public_acls      = true\n  restrict_public_buckets = true\n}\n\nresource \"aws_s3_bucket_server_side_encryption_configuration\" \"main\" {\n  bucket = aws_s3_bucket.main.id\n\n  rule {\n    apply_server_side_encryption_by_default {\n      sse_algorithm     = \"aws:kms\"\n      kms_master_key_id = aws_kms_key.s3.arn\n    }\n    bucket_key_enabled = true\n  }\n}\n\nresource \"aws_s3_bucket_lifecycle_configuration\" \"main\" {\n  bucket = aws_s3_bucket.main.id\n\n  rule {\n    id     = \"tier-down\"\n    status = \"Enabled\"\n\n    transition {\n      days          = 30\n      storage_class = \"STANDARD_IA\"\n    }\n\n    transition {\n      days          = 90\n      storage_class = \"GLACIER\"\n    }\n\n    noncurrent_version_transition {\n      noncurrent_days = 30\n      storage_class   = \"GLACIER\"\n    }\n\n    noncurrent_version_expiration {\n      noncurrent_days = 180\n    }\n\n    abort_incomplete_multipart_upload {\n      days_after_initiation = 7\n    }\n  }\n}\n\nresource \"aws_s3_bucket_policy\" \"enforce_https\" {\n  bucket = aws_s3_bucket.main.id\n\n  policy = jsonencode({\n    Version = \"2012-10-17\"\n    Statement = [{\n      Sid       = \"DenyInsecureTransport\"\n      Effect    = \"Deny\"\n      Principal = \"*\"\n      Action    = \"s3:*\"\n      Resource  = [\n        aws_s3_bucket.main.arn,\n        \"${aws_s3_bucket.main.arn}\u002F*\"\n      ]\n      Condition = {\n        Bool = { \"aws:SecureTransport\" = \"false\" }\n      }\n    }]\n  })\n}\n```\n\n## Troubleshooting\n\n| Problem | Cause | Fix |\n|---|---|---|\n| Access Denied on GetObject | Bucket policy or IAM denies access | Check bucket policy, IAM policy, and public access block |\n| Access Denied on PutObject | Missing encryption header when required | Add SSE header; check bucket policy encryption conditions |\n| 403 on presigned URL | URL expired or wrong region | Regenerate; ensure region matches bucket region |\n| Replication not working | Versioning disabled on source or dest | Enable versioning on both buckets |\n| Lifecycle not transitioning | Rule filter does not match objects | Verify prefix and tag filters; check rule status |\n| Bucket delete fails | Bucket not empty or has versioned objects | Delete all objects and versions first; disable versioning |\n| Slow uploads for large files | Single-part upload | Use `aws s3 cp` (auto multipart) or set multipart threshold |\n| Cross-account access denied | Both bucket policy AND IAM policy needed | Grant in bucket policy and in caller's IAM policy |\n| Object Lock prevents deletion | Governance or compliance mode active | Use governance bypass (with permission) or wait for retention |\n\n## Related Skills\n\n- aws-iam (`aws-iam`) - Bucket and object access policies\n- aws-vpc (`aws-vpc`) - VPC endpoints for private S3 access\n- aws-cost-optimization (`aws-cost-optimization`) - Storage class optimization\n- terraform-aws (`terraform-aws`) - IaC deployment for S3\n- cloudformation (`cloudformation`) - AWS-native S3 templates\n\n## Limitations\n\n- Infrastructure commands can disrupt services: confirm target host\u002Fscope and have backups\u002Fsnapshots before mutating state.\n- Docs-only import: upstream scripts and templates not bundled.\n\n",{"name":5,"risk":26,"source":43,"license":14,"category":44,"metadata":45,"date_added":48,"description":7,"source_repo":49,"source_type":29,"compatibility":50,"license_source":51},"https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills","devops",{"author":46,"version":47},"devops-skills","1.0","2026-09-20","BagelHole\u002FDevOps-Security-Agent-Skills","Requires the relevant OS\u002Fplatform tooling and privileged access where noted. Docs-only; helper scripts and templates not bundled.","https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills\u002Fblob\u002Fmain\u002FLICENSE","f3312ba749561b6159f477dbfc9313c875d40a56",".agents\u002Fskills_archive\u002Faws-s3","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612","2026-10-25 23:50:58",{"source":8,"skillName":5,"commands":58,"prompt":68,"zipAvailable":69},[59,62,65],{"tool":60,"command":61},"npx","npx skills add duc-duy-1612\u002FOnline-Delivery-Systems-Web --skill aws-s3",{"tool":63,"command":64},"bunx","bunx skills add duc-duy-1612\u002FOnline-Delivery-Systems-Web --skill aws-s3",{"tool":66,"command":67},"pnpm","pnpm dlx skills add duc-duy-1612\u002FOnline-Delivery-Systems-Web --skill aws-s3","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Faws-s3\u002FSKILL.md",true,[],[72,95,119,143,171,195],{"skillNo":73,"name":74,"nameZh":6,"description":75,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":76,"categories":77,"keywords":83,"publishedAt":38},"01M6Q0FA5FZ410Z33Z3TFQ4DBA","zero-trust","Implement zero-trust network architecture. Configure identity-based access, micro-segmentation, and continuous verification. Use when implementing modern security architectures.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fzero-trust\u002FSKILL.md",[78],{"categoryNo":79,"categoryName":80,"taxonomyType":81,"taxonomyTypeDesc":82},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",[84,85,86,87,88,89,74,90,37,35,34,31,29,28,91,26,92,93,23,94],"ZeRO","trust","zero trust","architecture","assessment","verification","segmentation","active","scope","scripts","implementing",{"skillNo":96,"name":97,"nameZh":6,"description":98,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":99,"categories":100,"keywords":101,"publishedAt":38},"01M6Q0F1YZJW3KX5FBKEVZ8CV4","zcode-delegate","Delegate coding tasks to the Z.AI ZCode CLI only when the user explicitly requests it, while the orchestrator retains review and landing responsibility.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fzcode-delegate\u002FSKILL.md",[],[102,103,104,105,106,107,108,109,110,111,112,113,114,31,115,29,116,117,26,118],"delegate","zcode","zcode delegate","review","cli","orchestration","tasks","run","Bash","model","node","read","orchestrator","files","desktop app","app","agent-orchestration",{"skillNo":120,"name":121,"nameZh":6,"description":122,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":123,"categories":124,"keywords":125,"publishedAt":38},"01M6Q0ETK41VGNMYEXW0T00AJN","youtube-transcript","Fetch YouTube transcripts through DeepAPI or local fallback tooling and save clean text output.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fyoutube-transcript\u002FSKILL.md",[],[126,127,128,129,130,131,132,22,133,134,135,136,137,29,28,138,139,140,141,142],"transcript","youtube transcript","youtube","safe","github","codex","research","https","text","fetch","tooling","clean","local","output","deepapi","youtube transcripts","blob",{"skillNo":144,"name":145,"nameZh":6,"description":146,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":147,"categories":148,"keywords":160,"publishedAt":38},"01M6Q0EPPH2PVMDW40017F8WX0","youtube-transcript-skills","Fetch YouTube video transcripts, search videos\u002Fchannels, browse channels, and extract playlists via the getyoutubetranscript.com API - free tier, no card required.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fyoutube-transcript-skills\u002FSKILL.md",[149,152,155],{"categoryNo":150,"categoryName":151,"taxonomyType":81,"taxonomyTypeDesc":82},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":153,"categoryName":154,"taxonomyType":81,"taxonomyTypeDesc":82},"01JBSEEDCAT000000000000016","图像与多媒体",{"categoryNo":156,"categoryName":157,"taxonomyType":158,"taxonomyTypeDesc":159},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[126,127,128,161,129,162,130,131,22,163,164,165,166,135,167,29,28,168,169,170],"youtube transcript skills","gemini","search","api","Video","browse","api-integration","free","card","channels",{"skillNo":172,"name":173,"nameZh":6,"description":174,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":175,"categories":176,"keywords":181,"publishedAt":38},"01M6Q0EAB96PX83W5PTE8A0R8D","youtube-notetaker","Turn YouTube talks into local study notes with slides, transcripts, editable annotations, and a markdown-backed viewer.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fyoutube-notetaker\u002FSKILL.md",[177,180],{"categoryNo":178,"categoryName":179,"taxonomyType":81,"taxonomyTypeDesc":82},"01JBSEEDCAT000000000000003","演示文稿",{"categoryNo":153,"categoryName":154,"taxonomyType":81,"taxonomyTypeDesc":82},[128,182,183,106,129,184,185,186,187,22,165,188,189,190,191,28,192,138,193,194],"youtube notetaker","notetaker","workflow","official","notes","code","markdown","slides","annotations","README","study","dair-academy","viewer",{"skillNo":196,"name":197,"nameZh":6,"description":198,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":199,"categories":200,"keywords":202,"publishedAt":38},"01M6Q0E55F0GW5MX48V8HXS8B5","youtube-full","Fetch YouTube transcripts, search videos, browse channels, and extract playlists via TranscriptAPI — no yt-dlp, no Google API key, works from any cloud server.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fyoutube-full\u002FSKILL.md",[201],{"categoryNo":150,"categoryName":151,"taxonomyType":81,"taxonomyTypeDesc":82},[203,128,204,205,129,162,163,206,207,164,165,166,135,208,167,29,28,168,209,141],"youtube full","full","google","server","dlp","credits","automatic"]