securing-s3-buckets

Implements layered, AWS Well-Architected security controls for Amazon S3 buckets across five distinct workflows: securing a new bucket, auditing an existing configuration, remediating a specific finding, configuring encryption, and enabling monitoring. Commands run through the AWS MCP server when connected, for sandboxed execution, audit logging, and observability, and fall back to the AWS CLI or shell otherwise. Before any work begins, required tools are checked and caller identity is confirmed with aws sts get-caller-identity. Each request is first classified into one of the five workflows, with required parameters gathered upfront and the bucket name and region confirmed before any write. Securing a new bucket follows a strict ordered sequence: create the bucket with --bucket-namespace account-regional, enable versioning, apply SSE-S3 encryption with Bucket Keys while blocking SSE-C, configure logging after asking which option the user wants, enforce HTTPS-only through a DenyInsecureTransport bucket policy, and enable ABAC. Block Public Access and ACL ownership controls (BucketOwnerEnforced) are deliberately left at their secure defaults. A set of put-bucket-policy safety rules governs every policy change: retrieve and back up any existing policy first, since put-bucket-policy replaces the entire document, merge new statements into the existing Statement array, and validate the merged JSON before applying. Audits are strictly read-only and report each control as PASS, FAIL, or NOT CONFIGURED with a severity. Encryption defaults to SSE-S3 with Bucket Keys; when KMS is requested it mandates a customer-managed key specified by full ARN, never the AWS-managed aws/s3 key. Monitoring covers GuardDuty (checking for an existing detector first), CloudTrail data events using the trail's home region, and core AWS Config rules. Use it to stand up a hardened bucket, review one against best practices, or fix findings such as missing encryption or insecure transport. Troubleshooting guidance covers AccessDenied diagnosis, silent policy statement removal, duplicate GuardDuty detectors, and CloudTrail region mismatches.