pip install s3tk

pip install awscli
aws configure

s3tk scan

s3tk scan my-bucket my-bucket-2

s3tk scan "my-bucket*"

s3tk scan --log-bucket my-s3-logs --log-bucket other-region-logs --log-prefix "{bucket}/"

s3tk scan --object-level-logging

s3tk scan --skip-logging --skip-versioning --skip-default-encryption

s3tk scan --sns-topic arn:aws:sns:...

s3tk list-policy

s3tk list-policy my-bucket my-bucket-2

s3tk list-policy --named

s3tk set-policy my-bucket --no-object-acl

s3tk delete-policy my-bucket

s3tk block-public-access my-bucket my-bucket-2

s3tk enable-logging --log-bucket my-s3-logs

s3tk enable-logging my-bucket my-bucket-2 --log-bucket my-s3-logs

s3tk enable-logging --log-bucket my-s3-logs --log-prefix "logs/{bucket}/"

s3tk enable-versioning

s3tk enable-versioning my-bucket my-bucket-2

s3tk enable-default-encryption

s3tk enable-default-encryption my-bucket my-bucket-2

s3tk scan-object-acl my-bucket

s3tk scan-object-acl my-bucket --only "*.pdf"

s3tk scan-object-acl my-bucket --except "*.jpg"

s3tk reset-object-acl my-bucket

s3tk encrypt my-bucket

s3tk encrypt my-bucket --kms-key-id arn:aws:kms:...

s3tk encrypt my-bucket --customer-key secret-key

s3tk delete-unencrypted-versions my-bucket

s3tk scan-dns

AWS_PROFILE=your-profile s3tk

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Scan",
            "Effect": "Allow",
            "Action": [
                "s3:ListAllMyBuckets",
                "s3:GetBucketAcl",
                "s3:GetBucketPolicy",
                "s3:GetBucketPublicAccessBlock",
                "s3:GetBucketLogging",
                "s3:GetBucketVersioning",
                "s3:GetEncryptionConfiguration"
            ],
            "Resource": "*"
        },
        {
            "Sid": "ScanObjectLevelLogging",
            "Effect": "Allow",
            "Action": [
                "cloudtrail:ListTrails",
                "cloudtrail:GetTrail",
                "cloudtrail:GetEventSelectors",
                "s3:GetBucketLocation"
            ],
            "Resource": "*"
        },
        {
            "Sid": "ScanDNS",
            "Effect": "Allow",
            "Action": [
                "s3:ListAllMyBuckets",
                "route53:ListHostedZones",
                "route53:ListResourceRecordSets"
            ],
            "Resource": "*"
        },
        {
            "Sid": "ListPolicy",
            "Effect": "Allow",
            "Action": [
                "s3:ListAllMyBuckets",
                "s3:GetBucketPolicy"
            ],
            "Resource": "*"
        },
        {
            "Sid": "SetPolicy",
            "Effect": "Allow",
            "Action": [
                "s3:PutBucketPolicy"
            ],
            "Resource": "*"
        },
        {
            "Sid": "DeletePolicy",
            "Effect": "Allow",
            "Action": [
                "s3:DeleteBucketPolicy"
            ],
            "Resource": "*"
        },
        {
            "Sid": "BlockPublicAccess",
            "Effect": "Allow",
            "Action": [
                "s3:ListAllMyBuckets",
                "s3:PutBucketPublicAccessBlock"
            ],
            "Resource": "*"
        },
        {
            "Sid": "EnableLogging",
            "Effect": "Allow",
            "Action": [
                "s3:ListAllMyBuckets",
                "s3:PutBucketLogging"
            ],
            "Resource": "*"
        },
        {
            "Sid": "EnableVersioning",
            "Effect": "Allow",
            "Action": [
                "s3:ListAllMyBuckets",
                "s3:PutBucketVersioning"
            ],
            "Resource": "*"
        },
        {
            "Sid": "EnableDefaultEncryption",
            "Effect": "Allow",
            "Action": [
                "s3:ListAllMyBuckets",
                "s3:PutEncryptionConfiguration"
            ],
            "Resource": "*"
        },
        {
            "Sid": "ResetObjectAcl",
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket",
                "s3:GetObjectAcl",
                "s3:PutObjectAcl"
            ],
            "Resource": [
                "arn:aws:s3:::my-bucket",
                "arn:aws:s3:::my-bucket/*"
            ]
        },
        {
            "Sid": "Encrypt",
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket",
                "s3:GetObject",
                "s3:PutObject"
            ],
            "Resource": [
                "arn:aws:s3:::my-bucket",
                "arn:aws:s3:::my-bucket/*"
            ]
        },
        {
            "Sid": "DeleteUnencryptedVersions",
            "Effect": "Allow",
            "Action": [
                "s3:ListBucketVersions",
                "s3:GetObjectVersion",
                "s3:DeleteObjectVersion"
            ],
            "Resource": [
                "arn:aws:s3:::my-bucket",
                "arn:aws:s3:::my-bucket/*"
            ]
        }
    ]
}

SELECT
    parse_datetime(requestdatetime, 'dd/MMM/yyyy:HH:mm:ss Z') AS time,
    key,
    remoteip,
    useragent
FROM
    s3_access_logs_db.mybucket_logs
WHERE
    requester = '-'
    AND httpstatus LIKE '2%'
    AND key LIKE 'some-keys%'
ORDER BY 1

SELECT
    eventtime,
    eventname,
    useridentity.username,
    requestparameters
FROM
    cloudtrail_logs
WHERE
    eventname LIKE '%Bucket%'
ORDER BY 1

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Deny",
            "Principal": "*",
            "Action": "s3:PutObjectAcl",
            "Resource": "arn:aws:s3:::my-bucket/*"
        }
    ]
}

resource "aws_s3_bucket" "my_bucket" {
  bucket = "my-bucket"
  acl    = "private"

  logging {
    target_bucket = "my-s3-logs"
    target_prefix = "my-bucket/"
  }

  versioning {
    enabled = true
  }
}

resource "aws_s3_bucket_public_access_block" "my_bucket" {
  bucket = "${aws_s3_bucket.my_bucket.id}"

  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

pip install s3tk --upgrade

pip install git+https://github.com/ankane/s3tk.git --upgrade

docker run -it ankane/s3tk aws configure

docker commit $(docker ps -l -q) my-s3tk

docker run -it my-s3tk s3tk scan

git clone https://github.com/ankane/s3tk.git
cd s3tk
pip install --group dev