How do I get the exports?

`aws s3api get-bucket-policy / get-bucket-acl / get-public-access-block / get-bucket-cors`. You run those; the skill stays offline.

What counts as public?

AWS Block Public Access definition — AllUsers/AuthenticatedUsers ACLs, or Principal `*` without a fixed-value condition key.

Does it understand policy variables?

It checks for fixed-value condition keys listed in the AWS public-policy rules (SourceIp, SourceVpc, PrincipalOrgID, …).

Run once per bucket's export set.

s3 bucket policy exposure auditor

Example session with this skill installed

Here are get-bucket-policy / acl / public-access-block / cors exports for bakery-uploads. Anything exposed?

Read your context and instructions
Compiled the s3 bucket policy

Answer: yes — 1 CRITICAL, 6 HIGH, 1 MEDIUM on the sample bakery-uploads exports.

CRITICAL: CORS allows AllowedOrigins: ["*"] with methods including PUT
HIGH: ACL grants READ to the predefined AllUsers group (public ACL per AWS docs)

HIGH: Block Public Access — `BlockPublicAcls`, `IgnorePublicAcls` and `BlockPublicPolicy` are all `false` (`RestrictPublicBuckets` is true)

HIGH: Bucket policy statement 0 allows Principal: "*" on s3:GetObject with no fixed-value condition (aws:SourceIp / aws:SourceVpc / aws:PrincipalOrgID / …)

HIGH: No Deny when aws:SecureTransport is false — bucket reachable over plain HTTP
MEDIUM: Statement 1 grants cross-account access to arn:aws:iam::123456789012:root

Deliverables: severity-sorted findings by source file; optional s3.md + JSON. Uses AWS's published definition of a public ACL / public policy.

Next steps: enable all four BPA flags, remove public ACL/policy statements or add fixed-value conditions, restrict CORS origins, add a SecureTransport deny. The skill never calls AWS or changes the bucket.

(Real run on bundled examples/{policy,acl,bpa,cors}.json.)

Connects securely to your tools. The creator never sees your data.

About this skill

Is this bucket public? Ask the exports, not the console hunches.

Evaluates bucket policy, ACL, Block Public Access and CORS JSON using AWS's own definition of "public" (AllUsers/AuthenticatedUsers ACLs; Principal * without fixed-value conditions). Flags public read/write, cross-account grants, BPA disabled, CORS Origin=* with write methods, and missing aws:SecureTransport deny.

What's included

SKILL.md, scripts/s3audit.py, sample policy/acl/bpa/cors JSON, references.

How to use

Skills on Agensi run inside your AI agent. Copy the prompt, paste it into your agent, and it connects to Agensi and installs this skill for you. If a payment is needed, your agent shows it to you first.

Reviews

No reviews yet

Be one of the first to try it. Every listed skill passes our trust checks below.

Security scanned

Passed our 8-point scan before listing

Fresh listing

Recently published to Agensi

Money-back guarantee

Doesn't do what its page promises? You get your money back.

s3 bucket policy exposure auditor