S3 Bucket Policy Condition Hardening Review Prompt
Review S3 bucket and access-point policies for over-broad principals, missing TLS/encryption conditions, and confused-deputy exposure
- Target user
- security-minded cloud DevOps engineers hardening AWS storage access
- Difficulty
- Intermediate
- Tools
- Claude, ChatGPT
The prompt
You are a senior DevSecOps engineer (defensive/blue-team) who hardens AWS S3 access policies against over-permission and cross-account abuse. I will provide: - My S3 bucket policy and any access-point or VPC-endpoint policies (JSON) - The intended access pattern: which principals, accounts, and services should read/write - Whether Block Public Access is enabled and which KMS key encrypts the bucket Your job: 1. **Principal scoping** — flag `Principal: "*"`, wildcard account roots, and overly broad `aws:PrincipalOrgID` gaps; recommend explicit principals or org/account conditions. 2. **Action minimization** — identify `s3:*` and unnecessary write/delete/ACL actions; reduce to the least set the workload needs. 3. **Transport & encryption conditions** — verify deny-without-`aws:SecureTransport` and require `s3:x-amz-server-side-encryption`; add missing conditions. 4. **Confused-deputy guards** — check for `aws:SourceArn`/`aws:SourceAccount` conditions on service principals and external-ID use for cross-account roles. 5. **Public-exposure interaction** — reconcile the policy with Block Public Access and any ACLs; flag combinations that could expose objects. 6. **Remediation policy** — produce a corrected, condition-tightened bucket policy. 7. **Detection** — recommend an IAM Access Analyzer / config rule check to catch future drift. Output as: a findings table (statement, issue, severity, fix), then a corrected bucket-policy JSON and a drift-detection recommendation. Do not loosen Block Public Access to satisfy an access need; solve it with scoped principals or access points instead.
Run this prompt with AI
Test it, get an AI-improved version, or compare models — live in the Prompt Workspace. No copy-paste.
Related prompts
-
CloudTrail Anomaly Hunting Review Prompt
Threat-hunt across AWS CloudTrail events to surface suspicious IAM, persistence, and exfiltration patterns and turn them into detections
-
Database Security Hardening Review Prompt
Audit and harden a production database (PostgreSQL/MySQL/MongoDB) — authentication, network exposure, encryption, least-privilege grants, and audit logging — without breaking applications.
-
Break-Glass Privileged Access Workflow Design Prompt
Design a just-in-time, audited break-glass procedure for emergency privileged access — time-boxed elevation, approval, full session recording, and automatic revocation — so admins aren't sitting on standing root.
-
Cloud Storage Public-Exposure Audit Prompt
Audit object storage (S3, GCS, Azure Blob) for public exposure — bucket policies, ACLs, account-level blocks, and access logging — and produce safe remediation that won't break legitimate access.
More DevOps Security & Hardening prompts & error guides
Browse every DevOps Security & Hardening prompt and troubleshooting guide in one place.
Reading prompts? Get all 500 in one free PDF
500 battle-tested, copy-paste AI prompts engineered by a senior systems engineer — every one with fill-in placeholders and safety/back-out notes. Drop your email and it's yours.
- 500 prompts: Linux · Kubernetes · Terraform · OpenStack · GitLab · Docker · Monitoring · Incident Response
- Instant PDF download — yours free, forever
- Plus one practical AI-workflow email a week (no spam)
Single opt-in · unsubscribe anytime · no spam.