S3 Commands¶
Bucket and object operations, with parallel transfer and a few things the AWS CLI does not make easy: version cleanup, Glacier restores, whole-bucket deletion, and an account-wide encryption report.
Three commands here delete data. nuke-bucket and delete-versions both support --dry-run; use it.
Commands¶
s3 analyze-encryption¶
Analyze S3 bucket encryption configurations with parallel processing.
| Option | Value | Description |
|---|---|---|
--region |
TEXT |
Filter buckets by region (default: analyze all regions) |
--output-file |
TEXT |
Output HTML file for encryption analysis report (default: s3_encryption_report_ |
--workers |
INTEGER |
Number of parallel workers for bucket analysis (default: from config) |
--tag-key |
TEXT |
Filter S3 buckets by tag key (e.g., Environment) |
--tag-value |
TEXT |
Filter S3 buckets by tag value (requires --tag-key) |
s3 bucket-details¶
Get comprehensive details about an S3 bucket including configuration and settings.
| Option | Value | Description |
|---|---|---|
--region |
TEXT |
AWS region where the bucket is located (default: auto-detect) |
--include-policies |
flag | Include bucket policies and ACLs |
--include-lifecycle |
flag | Include lifecycle configuration |
--include-cors |
flag | Include CORS configuration |
--include-website |
flag | Include website configuration |
--include-logging |
flag | Include logging configuration |
--include-all |
flag | Include all available bucket details |
--all-buckets |
flag | Get details for every bucket in the account |
--output-file |
TEXT |
Output file for bucket details (supports .json, .yaml) |
s3 create-bucket¶
Create a new S3 bucket with optional configuration.
| Option | Value | Description |
|---|---|---|
--region |
TEXT |
AWS region for the bucket (default: current region or us-west-2) |
--versioning |
flag | Enable versioning on the bucket |
--encryption |
flag | Enable default encryption on the bucket |
--public-access-block |
flag | Enable public access block (default: enabled) |
s3 delete-versions¶
Delete object versions from an S3 bucket.
| Option | Value | Description |
|---|---|---|
--prefix |
TEXT |
Prefix filter for S3 objects |
--region |
TEXT |
AWS region where the bucket is located (default: current region) |
--delete-all-versions |
flag | Delete ALL versions, not just those with delete markers |
--chunk-size |
INTEGER |
Number of objects to process in each batch (default: 1000) |
--dry-run |
flag | Show what would be deleted without actually deleting |
--confirm |
flag | Skip confirmation prompt |
s3 download¶
Download objects from an S3 bucket with parallel processing.
| Option | Value | Description |
|---|---|---|
--output-dir |
TEXT |
Output directory for downloads (default: ./s3_downloads_ |
--prefix |
TEXT |
Prefix filter for S3 objects to download |
--region |
TEXT |
AWS region where the bucket is located (default: current region) |
--include-versions |
flag | Include all versions of objects (not just latest) |
--delete-after-download |
flag | Delete objects from S3 after successful download |
--max-objects |
INTEGER |
Maximum number of objects to download (default: unlimited) |
--chunk-size |
INTEGER |
Number of objects to process in each batch (default: 1000) |
--max-retries |
INTEGER |
Maximum number of retries for failed downloads (default: 3) |
s3 list-buckets¶
List S3 buckets with details including region and optional size information.
| Option | Value | Description |
|---|---|---|
--region |
TEXT |
Filter buckets by region (default: show all regions) |
--all-regions |
flag | Show buckets from all regions (default behavior) |
--include-size |
flag | Include bucket size information from CloudWatch metrics |
--output-file |
TEXT |
Output file for bucket list (supports .json, .yaml, .csv) |
--tag-key |
TEXT |
Filter S3 buckets by tag key (e.g., Environment) |
--tag-value |
TEXT |
Filter S3 buckets by tag value (requires --tag-key) |
s3 nuke-bucket¶
Completely delete an S3 bucket and all its contents (including versions).
| Option | Value | Description |
|---|---|---|
--download-first |
flag | Download all objects before deleting the bucket |
--output-dir |
TEXT |
Output directory for downloads (if --download-first is used) |
--region |
TEXT |
AWS region where the bucket is located (default: current region) |
--dry-run |
flag | Show what would be deleted without actually deleting |
--confirm |
flag | Skip confirmation prompts |
s3 restore-objects¶
Restore objects from Glacier or other archive storage classes.
| Option | Value | Description |
|---|---|---|
--prefix |
TEXT |
Prefix filter for S3 objects |
--region |
TEXT |
AWS region where the bucket is located (default: current region) |
--restore-days |
INTEGER |
Number of days to keep restored objects available (default: 1) |
--restore-tier |
Standard | Bulk | Expedited |
Restore tier: Standard, Bulk, or Expedited (default: Standard) |
--include-versions |
flag | Include all versions of objects (not just latest) |
--check-status |
flag | Check restore status instead of initiating restore |
--max-objects |
INTEGER |
Maximum number of objects to process (default: unlimited) |
--dry-run |
flag | Show what would be restored without actually doing it |
Examples¶
# Buckets, with region and optional size
aws-cloud-utilities s3 list-buckets
aws-cloud-utilities s3 list-buckets --include-size --output-file buckets.csv
aws-cloud-utilities s3 list-buckets --tag-key Environment --tag-value production
# Full configuration for one bucket, or every bucket
aws-cloud-utilities s3 bucket-details my-bucket --include-all
aws-cloud-utilities s3 bucket-details --all-buckets --include-policies
# Account-wide encryption report (HTML)
aws-cloud-utilities s3 analyze-encryption --output-file s3-encryption.html
# Create a hardened bucket
aws-cloud-utilities s3 create-bucket my-new-bucket --versioning --encryption
# Download with a prefix filter and a cap
aws-cloud-utilities s3 download my-bucket --prefix logs/2026/ --output-dir ./s3-data --max-objects 5000
# Clean up delete markers, then all old versions
aws-cloud-utilities s3 delete-versions my-bucket --dry-run
aws-cloud-utilities s3 delete-versions my-bucket --delete-all-versions --prefix old/ --confirm
# Restore from Glacier and check on it
aws-cloud-utilities s3 restore-objects my-bucket --prefix archive/ --restore-days 7 --restore-tier Bulk
aws-cloud-utilities s3 restore-objects my-bucket --prefix archive/ --check-status
# Delete a bucket and everything in it
aws-cloud-utilities s3 nuke-bucket my-bucket --dry-run
aws-cloud-utilities s3 nuke-bucket my-bucket --download-first --output-dir ./backup --confirm
Destructive commands¶
| Command | What it removes | Safety |
|---|---|---|
delete-versions |
Non-current object versions; with --delete-all-versions, every version |
--dry-run, --confirm |
nuke-bucket |
Every object, every version, then the bucket itself | --dry-run, --download-first, --confirm |
Neither is recoverable. nuke-bucket --download-first pulls everything to local disk before deleting,
which is the only built-in undo.
Restore tiers¶
--restore-tier trades cost against speed: Expedited (1-5 minutes, most expensive), Standard
(3-5 hours), Bulk (5-12 hours, cheapest). --restore-days controls how long the restored copy stays
available before reverting to archive.
Restores are asynchronous. Initiate, then poll with --check-status.
Related¶
- CloudFront Commands - S3 origins and log destinations
- Logs Commands - process logs delivered to S3
- Billing Commands - CUR delivery buckets
- Security Commands - certificates for S3-backed sites