<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# AWS S3 Permissions — API Reference

## AWS CLI Commands

### Bucket Inventory

```bash
# List all buckets
aws s3api list-buckets --query 'Buckets[].Name' --output text

# Get bucket location/region
aws s3api get-bucket-location --bucket BUCKET_NAME

# Get bucket tagging
aws s3api get-bucket-tagging --bucket BUCKET_NAME
```

### Public Access Block

```bash
# Account-level public access block
aws s3control get-public-access-block --account-id ACCOUNT_ID
aws s3control put-public-access-block --account-id ACCOUNT_ID \
  --public-access-block-configuration BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true

# Bucket-level public access block
aws s3api get-public-access-block --bucket BUCKET_NAME
aws s3api put-public-access-block --bucket BUCKET_NAME \
  --public-access-block-configuration BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true
```

### Bucket Policy

```bash
# Get bucket policy
aws s3api get-bucket-policy --bucket BUCKET_NAME --output text | jq .

# Check if policy grants public access
aws s3api get-bucket-policy-status --bucket BUCKET_NAME

# Delete bucket policy
aws s3api delete-bucket-policy --bucket BUCKET_NAME
```

### ACL Management

```bash
# Get bucket ACL
aws s3api get-bucket-acl --bucket BUCKET_NAME

# Set private ACL
aws s3api put-bucket-acl --bucket BUCKET_NAME --acl private
```

### Encryption

```bash
# Get encryption configuration
aws s3api get-bucket-encryption --bucket BUCKET_NAME

# Enable SSE-S3 encryption
aws s3api put-bucket-encryption --bucket BUCKET_NAME \
  --server-side-encryption-configuration '{"Rules":[{"ApplyServerSideEncryptionByDefault":{"SSEAlgorithm":"AES256"}}]}'

# Enable SSE-KMS encryption
aws s3api put-bucket-encryption --bucket BUCKET_NAME \
  --server-side-encryption-configuration '{"Rules":[{"ApplyServerSideEncryptionByDefault":{"SSEAlgorithm":"aws:kms","KMSMasterKeyID":"KEY_ARN"}}]}'
```

### Logging & Versioning

```bash
# Get logging configuration
aws s3api get-bucket-logging --bucket BUCKET_NAME

# Enable logging
aws s3api put-bucket-logging --bucket BUCKET_NAME \
  --bucket-logging-status '{"LoggingEnabled":{"TargetBucket":"LOG_BUCKET","TargetPrefix":"s3-logs/"}}'

# Get versioning status
aws s3api get-bucket-versioning --bucket BUCKET_NAME

# Enable versioning
aws s3api put-bucket-versioning --bucket BUCKET_NAME --versioning-configuration Status=Enabled
```

## boto3 API

### Key Methods

| Method | Description |
|--------|-------------|
| `s3.list_buckets()` | List all buckets |
| `s3.get_bucket_acl(Bucket=)` | Get bucket ACL |
| `s3.get_bucket_policy(Bucket=)` | Get bucket policy JSON |
| `s3.get_public_access_block(Bucket=)` | Get public access block config |
| `s3.get_bucket_encryption(Bucket=)` | Get encryption config |
| `s3.get_bucket_logging(Bucket=)` | Get logging config |
| `s3.get_bucket_versioning(Bucket=)` | Get versioning status |
| `s3control.get_public_access_block(AccountId=)` | Account-level block |

## CIS Benchmark Controls

| Control | Description |
|---------|-------------|
| 2.1.1 | Ensure S3 bucket policy does not grant public access |
| 2.1.2 | Ensure S3 bucket-level public access blocks are configured |
| 2.1.4 | Ensure S3 buckets have server-side encryption enabled |
| 2.1.5 | Ensure S3 bucket access logging is enabled on the CloudTrail S3 bucket |
