The story of how convenient it was to turn routine tasks into custom slash commands with Claude Code

⏺ I'll create a custom slash command to automatically generate regular meeting agendas. First, let me check the current project structure and format of existing slash commands.

⏺ Search(pattern: "**/.claude/commands/*.md")
  ⎿  Found 0 files 

⏺ Search(pattern: "**/backlog-data/**/*.md")
  ⎿  Found 7 files (ctrl+o to expand)

⏺ Read(backlog-data/wiki/定例/20251029_定例MTG.md)
  ⎿  Read 93 lines

⏺ Read(backlog-data/issues/2025/SAMPLE-2.md)
  ⎿  Read 147 lines

⏺ Read(backlog-data/issues/2025/SAMPLE-4.md)
  ⎿  Read 151 lines

⏺ Let me check the remaining tickets and format of existing slash commands.

⏺ Read(backlog-data/issues/2025/SAMPLE-8.md)
  ⎿  Read 125 lines

⏺ Read(backlog-data/issues/2025/SAMPLE-10.md)
  ⎿  Read 157 lines

⏺ Read(backlog-data/issues/2025/SAMPLE-11.md)
  ⎿  Read 186 lines

⏺ Read(backlog-data/issues/2025/SAMPLE-24.md)
  ⎿  Read 155 lines

⏺ I'll create a new custom slash command for this project.

⏺ Bash(mkdir -p /Users/xxx/custom-slash/.claude/commands)
  ⎿  (No content)

⏺ Write(.claude/commands/create-meeting-agenda.md)
  ⎿  Wrote 86 lines to .claude/commands/create-meeting-agenda.md                                                         
     # 定例MTGアジェンダ作成
     以下の手順で定例MTGのアジェンダを自動生成してください。
     ## 1. チケット情報の収集
     `backlog-data/issues/2025/` ディレクトリ内の全てのチケットファイル（*.md）を読み込み、以下の情報を抽出してください：
     - 課題キー
     - チケット名（ファイルの1行目のタイトル）
     … +76 lines (ctrl+o to expand)

⏺ I've created the custom slash command.

  Created File

  .claude/commands/create-meeting-agenda.md

  How to Use

  /create-meeting-agenda

  Or, when specifying the date:

  /create-meeting-agenda 2025年11月12日 14:00-15:00

  What the Command Does

  1. Automatic ticket information collection
    - Reads all tickets in backlog-data/issues/2025/
    - Extracts key, title, status, assignee, and latest comments
  2. Previous meeting confirmation
    - Retrieves decisions and next actions from the latest meeting file in backlog-data/wiki/定例/
  3. Agenda file generation
    - Automatically generates a Markdown file in the specified format
    - Prioritizes in-progress tickets
    - Summarizes detailed status of each ticket from latest comments

  Current ticket status (example):
  | Ticket Key | Status |
  |--------------|------------|
  | SAMPLE-2     | Processed   |
  | SAMPLE-4     | Completed       |
  | SAMPLE-8     | Completed       |
  | SAMPLE-10    | In Progress     |
  | SAMPLE-11    | Completed       |
  | SAMPLE-24    | In Progress     |

  When you run the command, it will automatically generate an agenda based on this information.

---
marp: true
theme: classmethod
paginate: true
title: Amazon S3 Security Best Practices
description: Comprehensive guide to S3 security researched with AWS Knowledge MCP Server
---

<!-- _class: title -->
<!-- _paginate: false -->

![classmethod-logo w:400px](https://classmethod.jp/wp-content/themes/cmn/assets/images/common/logo_classmethod.svg)

# Amazon S3 Security Best Practices

2024/12/16 AWS Knowledge MCP Server Research Materials

---

<!-- _class: section -->
<!-- _paginate: false -->

## S3 Security Overview
Multi-layered defense approach for data protection

---

# Three Pillars of S3 Security

Amazon S3 security consists of three pillars:

## 1. **Access Control**
- IAM policies, bucket policies, ACLs (not recommended)

## 2. **Data Protection**
- Encryption at rest, encryption in transit

## 3. **Monitoring & Auditing**
- CloudTrail, S3 server access logs, AWS Config

---

<!-- _class: section -->
<!-- _paginate: false -->

## Access Control
Implementing the principle of least privilege

---

# Disable ACLs

Using S3 Object Ownership to disable ACLs is recommended

## Why disable ACLs?

- ACLs are unnecessary for modern use cases
- Policy-based access control is simpler and easier to manage
- Objects uploaded from different AWS accounts can be centrally managed

## Recommended setting

```
Bucket owner enforced
```

ACLs are disabled by default for new buckets

---

# S3 Block Public Access

Settings to reliably block public access

## Four blocking settings

| Setting | Description |
|------|------|
| BlockPublicAcls | Blocks addition of public ACLs |
| IgnorePublicAcls | Ignores existing public ACLs |
| BlockPublicPolicy | Blocks addition of public policies |
| RestrictPublicBuckets | Restricts public access |

## Best practices

- Enable all blocking settings at the **account level**
- Can be applied across the entire **organization** using AWS Organizations

---

# Principle of Least Privilege

Grant only the minimum necessary access permissions

## Implementation methods

- **IAM policies**: Permissions for users/roles
- **Bucket policies**: Resource-based permissions
- **VPC endpoint policies**: Control access via VPC
- **SCPs/RCPs**: Organization-level permission boundaries

## Check points

```json
// Examples to avoid
"Principal": "*"           // Anyone can access
"Action": "s3:*"          // All actions allowed
```

---

# Using IAM Roles

Use temporary credentials instead of long-term credentials

## Why use IAM roles?

- Eliminates risk of access key leakage
- Automatic credential rotation
- Secure S3 access from EC2, Lambda, ECS, etc.

## Anti-patterns

- Hardcoding credentials in application code
- Placing access keys on EC2 instances

---

<!-- _class: section -->
<!-- _paginate: false -->

## Data Protection
Multi-layered defense through encryption

---

# Encryption at Rest (Server-Side Encryption)

All new objects are encrypted by default since January 5, 2023

## Encryption options

| Option | Description | Use case |
|-----------|------|-------------|
| **SSE-S3** | S3-managed keys | Default setting |
| **SSE-KMS** | KMS-managed keys | Audit & fine-grained control |
| **DSSE-KMS** | Double encryption | Advanced compliance |
| **SSE-C** | Customer-provided keys | Special requirements only (not recommended) |

## Notes

- SSE-C will be disabled by default after April 2026
- SSE-KMS is effective for cross-account access

---

# Encryption in Transit

Enforce HTTPS (TLS) to protect data

## Force HTTPS with bucket policy

```json
{
  "Condition": {
    "Bool": {
      "aws:SecureTransport": "false"
    }
  },
  "Effect": "Deny"
}
```

## Supported TLS versions

- TLS 1.2 and TLS 1.3
- Post-quantum cryptography (ML-KEM) also supported

---

<!-- _class: section -->
<!-- _paginate: false -->

## Enhanced Data Protection
Prevent accidental deletion and tampering

---

<!-- _class: content-image-right content-60 -->

# S3 Versioning

Keep multiple versions of objects

![w:400px](https://d1.awsstatic.com/product-marketing/S3/S3_Object-Versioning.d8d66a47f24fb6bf9d51a2bf40c9e87a62ae0dd8.png)

## Benefits

- Recovery from accidental deletion
- Restoration of overwritten data
- Recovery from application errors

## AWS Config Rule

```
s3-bucket-versioning-enabled
```

---

# S3 Object Lock

Protect data with WORM (Write Once Read Many) model

## Retention modes

| Mode | Description |
|--------|------|
| **Governance** | Can be deleted with specific IAM permissions |
| **Compliance** | Cannot be deleted by anyone (even root user) |

## Use cases

- Protecting CloudTrail logs
- Meeting compliance requirements
- Ransomware protection

---

<!-- _class: section -->
<!-- _paginate: false -->

## Network Security
Protection using VPC endpoints

---

# Using VPC Endpoints

Access S3 without going through the internet

## Benefits

- No traversal of public internet
- Prevention of data exfiltration
- VPC endpoints can be specified in bucket policies

## Bucket policy example

```json
{
  "Condition": {
    "StringNotEquals": {
      "aws:SourceVpce": "vpce-1234567890abcdef0"
    }
  },
  "Effect": "Deny"
}
```

---

<!-- _class: section -->
<!-- _paginate: false -->

## Monitoring and Auditing
Detecting security incidents

---

# Auditing with CloudTrail

Record and monitor API calls to S3

## Recorded information

- Who: IAM user/role
- What: API action executed
- When: Timestamp
- Where: Source IP address

## Important actions to monitor

```
PutBucketPolicy, PutBucketAcl,
PutObjectAcl, DeleteBucket,
PutBucketWebsite
```

---

# S3 Server Access Logs

Detailed recording of requests to buckets

## Recorded content

- Source IP of request
- Requested object
- HTTP status code
- Error information

## AWS Config Rule

```
s3-bucket-logging-enabled
```

Can be used for security auditing and cost analysis

---

<!-- _class: column-layout -->

# Utilizing AWS Managed Services

<div class="column">

## Amazon Macie

- Automatic sensitive data discovery
- PII identification
- Data classification

</div>

<div class="column">

## AWS Security Hub

- Security configuration evaluation
- Compliance checks
- Centralized visualization

</div>

<div class="column">

## Amazon GuardDuty

- Threat detection
- Anomalous access detection
- S3 protection features

</div>

---

<!-- _class: section -->
<!-- _paginate: false -->

## Summary
S3 Security Checklist

---

# S3 Security Checklist

## Access Control
- [ ] Disable ACLs (Bucket owner enforced)
- [ ] Enable S3 Block Public Access
- [ ] Apply least privilege IAM policies
- [ ] Use IAM roles (instead of access keys)

## Data Protection
- [ ] Encrypt with SSE-S3 or SSE-KMS
- [ ] Enforce HTTPS (aws:SecureTransport)
- [ ] Enable S3 Versioning
- [ ] Apply S3 Object Lock for important data

---

# S3 Security Checklist (continued)

## Network
- [ ] Consider using VPC endpoints
- [ ] Restrict VPCs in bucket policies

## Monitoring & Auditing
- [ ] Record data events in CloudTrail
- [ ] Enable S3 server access logs
- [ ] Continuous monitoring with AWS Config rules
- [ ] Detect sensitive data with Amazon Macie

---

<!-- _class: all-text-center align-center -->

![w:450px](https://classmethod.jp/wp-content/themes/cmn/assets/images/common/logo_classmethod.svg)

# Thank You for Your Attention

Reference: AWS Official Documentation "Security best practices for Amazon S3"