AWS · Cloud service
Amazon S3 with OrchestrAI
Catalog exported 2026-09-02
Configure Amazon S3 from chat: buckets, encryption, versioning, lifecycle, policies, and public access blocks.
OrchestrAI exposes 13 S3 operations: 9 are low-risk (read-only or low-impact), 3 create or modify resources and run only after you confirm the plan, and 1 is destructive and requires a typed risk phrase. 1 of them also carries a step-level approval gate.
What teams use it for
Teams use OrchestrAI to create buckets with the right defaults, audit every bucket for missing default encryption, enforce SSE-KMS, block public access, enable versioning, set lifecycle rules and Intelligent-Tiering, apply a bucket policy that denies insecure transport, add tags, and configure event notifications. Listing buckets and objects is low risk, and deleting a bucket is critical with a typed risk phrase. Object operations are not included, so uploading, downloading, or deleting objects, and emptying a bucket before deletion, are done with the CLI or console.
Every S3 operation, with its risk level
| Operation | What it does | Risk | Step-level approval |
|---|---|---|---|
Audit S3 Bucket Encryption |
Read-only audit of default server-side encryption across S3 buckets; flags unencrypted buckets | Low risk | No |
List S3 Buckets |
List all S3 buckets in the account | Low risk | No |
List S3 Objects |
List objects in an S3 bucket | Low risk | No |
Set S3 Bucket Encryption |
Configure server-side encryption for an S3 bucket using SSE-S3, SSE-KMS, or DSSE-KMS | Low risk | No |
Set S3 Bucket Notification |
Configure event notifications on an S3 bucket | Low risk | No |
Set S3 Bucket Policy |
Set or replace the bucket policy for an S3 bucket (e.g., deny insecure transport) | Low risk | No |
Set S3 Bucket Tags |
Apply or replace tags on an S3 bucket | Low risk | No |
Set S3 Bucket Versioning |
Enable or suspend versioning on an S3 bucket | Low risk | No |
Set S3 Intelligent Tiering |
Configure S3 Intelligent-Tiering storage class for automatic cost-optimized data tiering | Low risk | No |
Create S3 Bucket |
Create a new Amazon S3 bucket | Creates resources | No |
Set S3 Bucket Lifecycle |
Configure lifecycle rules for an S3 bucket to manage object transitions and expiration | Creates resources | No |
Set S3 Public Access Block |
Configure S3 bucket public access block settings | Creates resources | No |
Delete S3 Bucket |
Delete an Amazon S3 bucket (must be empty) | Destructive | Yes |
Risk tiers come from the catalog: low is read-only or low-impact, medium creates resources and is reversible, high modifies existing resources, destructive may lose data. Every plan that creates or changes resources is shown with its cost estimate and waits for your confirmation. Operations marked with a step-level approval pause again on their own step. Destructive operations require a typed risk phrase.
Prompts that work
- Audit all S3 buckets in the account for default encryption and flag any that are unencrypted
- Enable SSE-KMS with alias/data-key and block all public access on the customer-exports bucket
- Add a lifecycle rule to the app-logs bucket that moves objects to Glacier after 90 days and expires them after 365
Before anything runs
Every mutation shows its plan, cost estimate, and blast radius, then waits for your confirmation. Destructive operations require a typed risk phrase. Credentials are minted per run through OIDC federation and discarded afterward; nothing you create here is invisible later, because every resource lands in the desired-state ledger where drift is detected and can be converged. Details on the security page.
Frequently asked questions
- Can OrchestrAI upload or delete objects in S3?
- No, it lists objects and manages bucket configuration, but object-level writes are outside the current operations.
- What does the S3 encryption audit in OrchestrAI do?
- It reads the default encryption setting on every bucket and flags the ones without server-side encryption. It is read-only and rated low risk.
- Which S3 operations need an extra approval step?
- One operation carries a step-level approval gate on top of plan confirmation: Delete S3 Bucket. It is classed destructive and cannot run without a typed risk phrase.
Other AWS services
Related integrations
Try it on your own account
Connect your cloud read-only and see your resources, drift, and costs before anything runs. $5 minimum to start. Unused credits refunded in your first 14 days.
Unused credits refunded in your first 14 days.