storage-s3-resiliency-expertise

Files (12)

• .skilleval.yaml
• CHANGELOG.md
• README.md
• SKILL.md
• eval_queries.json · evals/
• evals.json · evals/
• bucket-context.json · evals/files/
• data-collection.md · references/
• finding-logic.md · references/
• fleet-orchestration.md · references/
• report-format.md · references/
• s3-resiliency-best-practices.md · references/

SKILL.md (first lines)

# S3 Resiliency Review

Perform a structured, read-only resiliency, security, and data protection review
of Amazon S3 buckets. Automatically handles single-bucket and multi-bucket (fleet)
reviews based on how many buckets are provided.

## When to Use

Activate this skill when the user asks to:
- Review, audit, or assess an S3 bucket's resiliency, security, or data protection
- Evaluate an S3 bucket's protection/recovery posture or disaster recovery readiness
- Check any of: versioning, replication, object lock, encryption, block public
  access, bucket policy, ownership controls, server access logging, website hosting
- Review a list of buckets ("review these buckets: A, B, C")

Do NOT activate for cost optimization, performance tuning, or EFS/FSx/AWS
Backup/Storage Gateway.

## Architecture

- **This skill (orchestrator/analyzer):** input parsing, routing, finding logic
  application, report rendering.
- **Data collection:** `references/data-collection.md` — the read-only control-plane
  API calls used to gather bucket configuration and the structured object they
  produce. Data is acquired with the agent's native `use_aws` tool under the
  assumed role in the target account. No credentials or profile are requested from
  the user.
- **Finding logic:** `references/finding-logic.md` — all severity rules and body
  templates.
- **Report format:** `references/report-format.md` — report structure, dimensions
  table, pre-render validation.
- **Fleet orchestration:** `references/fleet-orchestration.md` — batching, caching,
  manifest, diffing (loaded only for multi-bucket reviews).
- **Operational depth:** `references/s3-resiliency-best-practices.md` — reasoning
  behind thresholds, replication risk model, encryption tradeoffs, ownership
  migration patterns, triage decision tree.

## Input Parsing & Validation

### Accepted input formats

- Single bucket name: `my-production-bucket`
- Comma-separated: `bucket-a, bucket-b, bucket-c`
- Newline-separated (pasted list)
- File reference: "review buckets in buckets.txt" (read file, one bucket per line)
- S3 URI/ARN/URL wrappers (stripped automatically per rules below)

### Wrapper recognition

Strip the bucket name from these patterns before collecting data:
- `s3://`, `s3a://`, `s3n://` — take the first path segment after the scheme
- `arn:aws:s3:::`, `arn:aws-cn:s3:::`, `arn:aws-us-gov:s3:::` — take the segment after `:::`
- `https://<bucket>.s3.amazonaws.com`, `https://<bucket>.s3.<region>.amazonaws.com` — take the subdomain
- `https://<bucket>.s3-website-<region>.amazonaws.com` — take the subdomain
- `https://s3.amazonaws.com/<bucket>`, `https://s3.<region>.amazonaws.com/<bucket>` — take the first path segment
- Bare bucket name (no prefix) — use as-is

When a wrapper is extracted, surface it: "Reviewing bucket `my-bucket` (extracted from `s3://my-bucket/path`)."

### Reject (abort without API call)

- Empty string or whitespace only → "No bucket name was provided."
- Single input contains `/` with no recognized wrapper prefix → "The input looks like a bucket name with a path. Did you mean to review bucket `<first-segment>`?"

### Do NOT enforce S3 naming rules client-side

Legacy buckets can have characters strict validation would reject. HeadBucket is
the source of truth.

## Routing

After parsing, route based on bucket count. **The user never chooses. Routing is
automatic and silent.**

| Count | Path | Behavior |
|---|---|---|
| 1 | Single-bucket | Full report with all details |
| 2-10 | Fleet (single pass) | Summary matrix + full details for all |
| 11-20 | Fleet (single pass) | Summary matrix + details for Low-rated only |
| 21+ | Fleet (batched) | Batches of 10, manifest tracking, resume support |

## Single-Bucket Path

### Execution flow

1. Collect bucket configuration per `references/data-collection.md`.
2. If region discovery fails (bucket does not exist or the role has no access) →
   abort: "Bucket `<name>` does not exist or the role does not have access."
3. Evaluate pre-flight: check all `status` fields in the collected data.
   - If any `AccessDenied` → present permissions audit (see Pre-flight section)
   - If any `ToolingFailure` → present tooling notice (see Pre-flight section)
   - If no gaps → proceed
4. Load `references/finding-logic.md`.
5. Apply finding logic against the structured configuration data.
6. Load `references/report-format.md`.
7. Render the single-bucket report.
8. Run the pre-render validation (13 checks).
9. Deliver the report per the **Final Delivery Contract** below.

### Pre-flight: Permissions audit

If any check returned `AccessDenied`, present:

> ⚠️ The role is missing read permissions for some configurations.
>
> | Check | Status |
> |---|---|
> | `<check name>` | AccessDenied |
>
> The minimum policy required includes the read actions for each check above.
>
> How would you like to proceed?
> 1. **Stop here (recommended).** Add the missing permissions and re-run.
> 2. **Continue with reduced accuracy.** Report will note gaps; rating capped at Medium.

Wait for user response. Do NOT proceed by default.

### Pre-flight: Tooling notice

From aws/tools-for-devops-agent, Apache-2.0.

More from aws/tools-for-devops-agent