---
name: s3-secure-storage
description: Create a production-ready, secure Amazon S3 bucket with versioning and a lifecycle policy. Use when the user asks to create an S3 bucket, enable versioning, add lifecycle rules, transition objects to Glacier or an archive tier, block public access, or encrypt a bucket. Delivers infrastructure-as-code (AWS CDK and CloudFormation) with secure defaults — Block Public Access, default encryption, a TLS-only bucket policy, versioning, and a lifecycle rule that transitions objects to Glacier after 90 days — following AWS Well-Architected best practices.
license: Apache-2.0
metadata:
  source: agent-toolkit-for-aws
---

# Secure S3 storage

Create an S3 bucket that is private, encrypted, versioned, and cost-managed via
lifecycle rules — defined as infrastructure-as-code. Follow the
`working-with-aws` guardrails.

This is the plugin's reference implementation of the Agent Toolkit example:
*"Create an S3 bucket with versioning enabled and a lifecycle policy that
transitions objects to Glacier after 90 days."*

## Secure defaults (always apply)

- **Block Public Access** — all four settings on, at the bucket level.
- **Default encryption** — SSE-S3 (`AES256`) at minimum; SSE-KMS with a CMK when
  the workload needs key control or audit.
- **TLS-only** — a bucket policy that denies requests where
  `aws:SecureTransport` is `false`.
- **Versioning enabled** — protects against overwrite and accidental deletion.
- **Ownership** — `BucketOwnerEnforced` (ACLs disabled) unless a specific
  cross-account ACL need exists.

## Lifecycle policy

- Transition noncurrent and current objects to **Glacier Flexible Retrieval**
  after **90 days**.
- Expire *noncurrent* versions after a retention window (e.g. 365 days) so
  versioning does not grow cost unbounded.
- Abort incomplete multipart uploads after 7 days.

Choose the archive tier deliberately: **Glacier Instant Retrieval** for
ms-access archives, **Glacier Flexible Retrieval** for minutes-to-hours, or
**Glacier Deep Archive** for the cheapest, rarely-accessed data.

## Deploy

See [references/versioning-and-lifecycle.md](references/versioning-and-lifecycle.md)
for the complete, copy-paste **AWS CDK** and **CloudFormation** templates that
implement every default above. Pick one, set the bucket name (or let CDK/CFN
generate it), and deploy.

- **CDK:** `cdk deploy`
- **CloudFormation:** `aws cloudformation deploy --template-file s3-secure.yaml --stack-name secure-bucket`

## Verify

1. `aws s3api get-bucket-versioning --bucket <name>` returns `Status: Enabled`.
2. `aws s3api get-bucket-lifecycle-configuration --bucket <name>` shows the
   90-day Glacier transition.
3. `aws s3api get-public-access-block --bucket <name>` shows all four flags true.
4. A plain `http://` request is denied; `https://` succeeds.

Prefer IaC over `aws s3 mb` + a series of `put-bucket-*` calls: the template is
reviewable, repeatable, and cleanly destroyable.