Secure S3 storage

Create an S3 bucket that is private, encrypted, versioned, and cost-managed via lifecycle rules — defined as infrastructure-as-code. Follow the working-with-aws guardrails.

This is the plugin's reference implementation of the Agent Toolkit example: "Create an S3 bucket with versioning enabled and a lifecycle policy that transitions objects to Glacier after 90 days."

Secure defaults (always apply)

• Block Public Access — all four settings on, at the bucket level.
• Default encryption — SSE-S3 (AES256) at minimum; SSE-KMS with a CMK when the workload needs key control or audit.
• TLS-only — a bucket policy that denies requests where aws:SecureTransport is false.
• Versioning enabled — protects against overwrite and accidental deletion.
• Ownership — BucketOwnerEnforced (ACLs disabled) unless a specific cross-account ACL need exists.

Lifecycle policy

• Transition noncurrent and current objects to Glacier Flexible Retrieval after 90 days.
• Expire noncurrent versions after a retention window (e.g. 365 days) so versioning does not grow cost unbounded.
• Abort incomplete multipart uploads after 7 days.

Choose the archive tier deliberately: Glacier Instant Retrieval for ms-access archives, Glacier Flexible Retrieval for minutes-to-hours, or Glacier Deep Archive for the cheapest, rarely-accessed data.

Deploy

See references/versioning-and-lifecycle.md for the complete, copy-paste AWS CDK and CloudFormation templates that implement every default above. Pick one, set the bucket name (or let CDK/CFN generate it), and deploy.

• CDK: cdk deploy
• CloudFormation: aws cloudformation deploy --template-file s3-secure.yaml --stack-name secure-bucket

Verify

1. aws s3api get-bucket-versioning --bucket <name> returns Status: Enabled.
2. aws s3api get-bucket-lifecycle-configuration --bucket <name> shows the 90-day Glacier transition.
3. aws s3api get-public-access-block --bucket <name> shows all four flags true.
4. A plain http:// request is denied; https:// succeeds.

Prefer IaC over aws s3 mb + a series of put-bucket-* calls: the template is reviewable, repeatable, and cleanly destroyable.