A story about how it was convenient to make frequently performed routine tasks into Claude Code custom slash commands

⏺ I'll create a custom slash command for automatically generating regular meeting agendas. First, let me check the current project structure and existing slash command format.

⏺ Search(pattern: "**/.claude/commands/*.md")
  ⎿  Found 0 files 

⏺ Search(pattern: "**/backlog-data/**/*.md")
  ⎿  Found 7 files (ctrl+o to expand)

⏺ Read(backlog-data/wiki/定例/20251029_定例MTG.md)
  ⎿  Read 93 lines

⏺ Read(backlog-data/issues/2025/SAMPLE-2.md)
  ⎿  Read 147 lines

⏺ Read(backlog-data/issues/2025/SAMPLE-4.md)
  ⎿  Read 151 lines

⏺ Let me check the remaining tickets and existing slash command format.

⏺ Read(backlog-data/issues/2025/SAMPLE-8.md)
  ⎿  Read 125 lines

⏺ Read(backlog-data/issues/2025/SAMPLE-10.md)
  ⎿  Read 157 lines

⏺ Read(backlog-data/issues/2025/SAMPLE-11.md)
  ⎿  Read 186 lines

⏺ Read(backlog-data/issues/2025/SAMPLE-24.md)
  ⎿  Read 155 lines

⏺ I'll create a new custom slash command for this project.

⏺ Bash(mkdir -p /Users/xxx/custom-slash/.claude/commands)
  ⎿  (No content)

⏺ Write(.claude/commands/create-meeting-agenda.md)
  ⎿  Wrote 86 lines to .claude/commands/create-meeting-agenda.md                                                         
     # 定例MTGアジェンダ作成
     以下の手順で定例MTGのアジェンダを自動生成してください。
     ## 1. チケット情報の収集
     `backlog-data/issues/2025/` ディレクトリ内の全てのチケットファイル（*.md）を読み込み、以下の情報を抽出してください：
     - 課題キー
     - チケット名（ファイルの1行目のタイトル）
     … +76 lines (ctrl+o to expand)

⏺ I've created a custom slash command.

  Created file

  .claude/commands/create-meeting-agenda.md

  How to use

  /create-meeting-agenda

  Or, to specify the date:

  /create-meeting-agenda 2025年11月12日 14:00-15:00

  What the command does

  1. Automatic collection of ticket information
    - Reads all tickets in backlog-data/issues/2025/
    - Extracts ticket key, title, status, assignee, latest comment
  2. Checking previous regular meetings
    - Gets decisions and next actions from the latest regular meeting file in backlog-data/wiki/定例/
  3. Agenda file generation
    - Automatically generates a Markdown file in the specified format
    - Prioritizes tickets in progress
    - Summarizes detailed status of each ticket from latest comments

  Current ticket status (example):
  | Ticket key | Status |
  |--------------|------------|
  | SAMPLE-2     | Processed   |
  | SAMPLE-4     | Completed       |
  | SAMPLE-8     | Completed       |
  | SAMPLE-10    | In progress     |
  | SAMPLE-11    | Completed       |
  | SAMPLE-24    | In progress     |

  When you execute the command, an agenda will be automatically generated based on this information.

---
marp: true
theme: classmethod
paginate: true
title: Amazon S3 Security Best Practices
description: Comprehensive guide to S3 security researched with AWS Knowledge MCP Server
---

<!-- _class: title -->
<!-- _paginate: false -->

![classmethod-logo w:400px](https://classmethod.jp/wp-content/themes/cmn/assets/images/common/logo_classmethod.svg)

# Amazon S3 Security Best Practices

2024/12/16 AWS Knowledge MCP Server Research Materials

---

<!-- _class: section -->
<!-- _paginate: false -->

## Overview of S3 Security
Multi-layered approach to data protection

---

# Three Pillars of S3 Security

Amazon S3 security consists of the following three pillars:

## 1. **Access Control**
- IAM policies, bucket policies, ACLs (not recommended)

## 2. **Data Protection**
- Encryption at rest, encryption in transit

## 3. **Monitoring & Auditing**
- CloudTrail, S3 server access logs, AWS Config

---

<!-- _class: section -->
<!-- _paginate: false -->

## Access Control
Implementing the principle of least privilege

---

# Disable ACLs

Recommended to disable ACLs using S3 Object Ownership

## Why disable ACLs?

- ACLs are unnecessary for modern use cases
- Policy-based access control is simpler and easier to manage
- Enables centralized management of objects uploaded from different AWS accounts

## Recommended setting

```
Bucket owner enforced
```

ACLs are disabled by default for new buckets

---

# S3 Block Public Access

Settings to reliably block public access

## Four block settings

| Setting | Description |
|------|------|
| BlockPublicAcls | Block addition of public ACLs |
| IgnorePublicAcls | Ignore existing public ACLs |
| BlockPublicPolicy | Block addition of public policies |
| RestrictPublicBuckets | Restrict public access |

## Best practices

- Enable all block settings at the **account level**
- Can be applied to the **entire organization** with AWS Organizations

---

# Principle of Least Privilege

Grant only the minimum required access permissions

## Implementation methods

- **IAM policies**: Permissions for users/roles
- **Bucket policies**: Resource-based permissions
- **VPC endpoint policies**: Control access via VPC
- **SCPs/RCPs**: Organization-level permission boundaries

## Check points

```json
// Settings to avoid
"Principal": "*"           // Anyone can access
"Action": "s3:*"          // Allow all actions
```

---

# Using IAM Roles

Use temporary credentials instead of long-term credentials

## Why use IAM roles?

- Eliminate the risk of access key leakage
- Automatic credential rotation
- Secure access to S3 from EC2, Lambda, ECS, etc.

## Anti-patterns

- Hardcoding credentials in application code
- Placing access keys on EC2 instances

---

<!-- _class: section -->
<!-- _paginate: false -->

## Data Protection
Multi-layered defense through encryption

---

# Encryption at Rest (Server-Side Encryption)

All new objects are encrypted by default since January 5, 2023

## Encryption options

| Option | Description | Use case |
|-----------|------|-------------|
| **SSE-S3** | S3 managed keys | Default setting |
| **SSE-KMS** | KMS managed keys | Audit & fine-grained control |
| **DSSE-KMS** | Double encryption | Advanced compliance |
| **SSE-C** | Customer-provided keys | Special requirements only (not recommended) |

## Notes

- SSE-C will be disabled by default after April 2026
- SSE-KMS is effective for cross-account access

---

# Encryption in Transit

Enforce HTTPS (TLS) to protect data

## Enforce HTTPS with bucket policy

```json
{
  "Condition": {
    "Bool": {
      "aws:SecureTransport": "false"
    }
  },
  "Effect": "Deny"
}
```

## Supported TLS versions

- TLS 1.2 and TLS 1.3
- Post-quantum cryptography (ML-KEM) also supported

---

<!-- _class: section -->
<!-- _paginate: false -->

## Enhanced Data Protection
Preventing accidental deletion and tampering

---

<!-- _class: content-image-right content-60 -->

# S3 Versioning

Maintain multiple versions of objects

![w:400px](https://d1.awsstatic.com/product-marketing/S3/S3_Object-Versioning.d8d66a47f24fb6bf9d51a2bf40c9e87a62ae0dd8.png)

## Benefits

- Recovery from accidental deletion
- Restoration of overwritten data
- Recovery from application errors

## AWS Config Rule

```
s3-bucket-versioning-enabled
```

---

# S3 Object Lock

Protect data with WORM (Write Once Read Many) model

## Retention modes

| Mode | Description |
|--------|------|
| **Governance** | Can be deleted with specific IAM permissions |
| **Compliance** | Cannot be deleted by anyone (including root user) |

## Use cases

- Protection of CloudTrail logs
- Meeting compliance requirements
- Ransomware protection

---

<!-- _class: section -->
<!-- _paginate: false -->

## Network Security
Protection with VPC endpoints

---

# Utilizing VPC Endpoints

Access S3 without traversing the internet

## Benefits

- No traversal of public internet
- Prevention of data exfiltration
- Can specify VPC endpoints in bucket policies

## Example bucket policy

```json
{
  "Condition": {
    "StringNotEquals": {
      "aws:SourceVpce": "vpce-1234567890abcdef0"
    }
  },
  "Effect": "Deny"
}
```

---

<!-- _class: section -->
<!-- _paginate: false -->

## Monitoring and Auditing
Detection of security incidents

---

# Auditing with CloudTrail

Record and monitor API calls to S3

## Information recorded

- Who: IAM user/role
- What: API action executed
- When: Timestamp
- Where: Source IP address

## Important actions to monitor

```
PutBucketPolicy, PutBucketAcl,
PutObjectAcl, DeleteBucket,
PutBucketWebsite
```

---

# S3 Server Access Logs

Detailed recording of requests to buckets

## Recorded information

- Source IP of request
- Requested object
- HTTP status code
- Error information

## AWS Config Rule

```
s3-bucket-logging-enabled
```

Can be used for security auditing and cost analysis

---

<!-- _class: column-layout -->

# Using AWS Managed Services

<div class="column">

## Amazon Macie

- Automatic detection of sensitive data
- PII identification
- Data classification

</div>

<div class="column">

## AWS Security Hub

- Evaluation of security settings
- Compliance checks
- Centralized visibility

</div>

<div class="column">

## Amazon GuardDuty

- Threat detection
- Detection of abnormal access
- S3 protection features

</div>

---

<!-- _class: section -->
<!-- _paginate: false -->

## Summary
S3 Security Checklist

---

# S3 Security Checklist

## Access Control
- [ ] Disable ACLs (Bucket owner enforced)
- [ ] Enable S3 Block Public Access
- [ ] Apply least privilege IAM policies
- [ ] Use IAM roles (instead of access keys)

## Data Protection
- [ ] Encrypt with SSE-S3 or SSE-KMS
- [ ] Enforce HTTPS (aws:SecureTransport)
- [ ] Enable S3 Versioning
- [ ] Apply S3 Object Lock to important data

---

# S3 Security Checklist (continued)

## Network
- [ ] Consider using VPC endpoints
- [ ] Restrict VPC in bucket policies

## Monitoring & Auditing
- [ ] Record data events in CloudTrail
- [ ] Enable S3 server access logs
- [ ] Continuous monitoring with AWS Config rules
- [ ] Detect sensitive data with Amazon Macie

---

<!-- _class: all-text-center align-center -->

![w:450px](https://classmethod.jp/wp-content/themes/cmn/assets/images/common/logo_classmethod.svg)

# Thank You for Your Attention

Reference: AWS Official Documentation "Security best practices for Amazon S3"