How to use the Auditing AWS S3 Bucket Permissions agent skill

What does the auditing AWS S3 bucket permissions skill make the agent do?

The skill gives the agent a structured checklist for reviewing an AWS account's S3 storage buckets. According to the skill's description, it systematically looks for publicly accessible buckets, overly permissive ACLs, misconfigured bucket policies, and missing encryption settings.

The checklist covers Block Public Access settings at account and bucket level, bucket ACL grants to AllUsers and AuthenticatedUsers, bucket policies with wildcard principals, server-side encryption, versioning and server access logging. It also points to Prowler's S3 checks for CIS benchmark alignment and to IAM Access Analyzer for external sharing findings. The skill can suggest or run remediation such as enabling Block Public Access.

What do you need before installing the skill?

The checks need an authenticated AWS account. The skill's prerequisites are AWS CLI v2 with credentials that have S3 read permissions, Python 3.8+ with boto3, and Prowler (installed with pip install prowler) for CIS benchmark checks. An S3audit or similar enumeration tool is optional, as is AWS Organizations access for multi-account audits.

• AWS CLI v2 with s3:GetBucketPolicy, s3:GetBucketAcl, s3:GetBucketPublicAccessBlock, s3:GetEncryptionConfiguration and s3:ListAllMyBuckets permissions
• Prowler, installed with pip install prowler
• Python 3.8+ with boto3
• Optional: S3audit or similar tool, and AWS Organizations access for multiple accounts

How do you install the skill?

Download the skill ZIP from this page and unzip it. For a personal install, place the skill folder in ~/.claude/skills/. For a single project, place it in that project's .claude/skills/ folder.

You can also upload the ZIP in the Claude apps under Settings → Capabilities → Skills.

• Personal: unzip into ~/.claude/skills/
• Project: unzip into your project's .claude/skills/
• Claude apps: Settings → Capabilities → Skills, then upload the ZIP

How do you trigger the skill with a natural request?

You do not need a special command. Describe what you want in plain language and mention S3 or bucket permissions. The agent should match your request to the skill's description and follow its workflow.

Good requests name the goal and the scope, for example which account or whether you need a quick exposure check or a full baseline.

• Check my AWS account for publicly accessible S3 buckets.
• Review the bucket policies and ACLs in this AWS account for overly permissive access.
• We have a SOC 2 review next month. Audit our S3 encryption, versioning and logging settings.
• We think a credential leaked. Find every S3 bucket that could be reached from outside and tell me what to lock down first.

What does a typical audit look like?

The skill's workflow runs in steps. It first lists buckets and checks account-level Block Public Access, then checks each bucket's public access block and ACL grants. Next it reviews bucket policies for wildcard principals, checks encryption, versioning and logging, runs Prowler's S3 checks, and reviews IAM Access Analyzer findings. The final step compiles a report and offers remediation.

The skill includes a Python script, scripts/agent.py, which uses boto3 to automate part of the listing and checking. A reference file, references/api-reference.md, contains boto3 S3 client examples for listing buckets, reading ACLs, Block Public Access and bucket policies.

• Enumerate buckets and account-level Block Public Access
• Check per-bucket Block Public Access and ACL grants
• Analyze bucket policies
• Verify encryption, versioning and logging
• Run Prowler S3 checks and Access Analyzer findings
• Generate a report and remediate

What are the safety notes for running this skill?

This skill runs scripts and uses the network. Its checks call AWS APIs with your credentials, and its remediation steps change live resources. The skill's remediation examples include enabling Block Public Access, enabling default encryption and enabling versioning on a target bucket.

Review each command before the agent runs it, especially any put or change operation. Test in a non-production account where possible. The skill is not for real-time monitoring; it points to S3 Event Notifications with Lambda for that.

• The skill runs scripts and makes network calls to AWS
• Remediation commands modify bucket configuration; confirm the target bucket first
• Use credentials with the least privilege needed for read-only checks where you can

What tips help you get reliable results?

Run the read-only checks first and review the output before asking for any fixes. Name the bucket you want changed so the agent does not guess. If you audit several accounts, confirm you have AWS Organizations access first.

Remember the scope limits. The skill is for AWS S3 only. For Google Cloud Storage or Azure Blob, use provider-specific tools. For access-pattern analysis, the skill points to S3 Access Analyzer or CloudTrail S3 data events.

• Start with read-only checks, then decide on remediation
• Name the exact bucket for any change
• Use Prowler's CSV or JSON-OCSF output for records