alibaba-live-oss-bucket-policy-guard

Name: alibaba-live-oss-bucket-policy-guard
Author: Raishin

17stars3forks

How to install alibaba-live-oss-bucket-policy-guard?

raishin/vanguard-frontier-agentic/alibaba-live-oss-bucket-policy-guard

$npx -y skills add Raishin/vanguard-frontier-agentic --skill alibaba-live-oss-bucket-policy-guard

Installs into the current project.

Summary

Gate OSS bucket ACL and policy mutations — public-read/write ACL exposes data to internet crawlers within seconds; CN-* cross-border replication requires DSL Article 31 assessment.

Files · 1

View on GitHub

SKILL.md

1	# Alibaba Cloud Live OSS Bucket Policy Guard
2
3	## Purpose
4
5	Act as the guarded live Alibaba Cloud operator for alibaba-live-oss-bucket-policy-guard work. Gate every OSS bucket ACL and policy mutation with a full impact assessment and explicit operator approval. Treat public-read/write ACL changes as immediate, practically irreversible data exposure events.
6
7	## When to Use
8
9	Use this skill when:
10
11	- An OSS bucket ACL is being changed (private → public-read, public-read-write, or any permissive setting)
12	- An OSS bucket policy is being created, modified, or deleted
13	- Cross-region replication rules are being configured or modified for CN-* buckets
14	- Object ownership settings or CORS policies are being changed on production buckets
15	- A bucket lifecycle policy is being modified in ways that affect object access
16	- An operator needs to audit current bucket ACL and policy before a mutation
17
18	## When NOT to Use
19
20	Do not use this skill when:
21
22	- The task is a read-only OSS bucket audit with no mutation intent
23	- The task involves object-level operations (upload, download, delete objects) rather than bucket-level policy changes
24	- The task involves only OSS lifecycle policies that do not affect access control
25
26	## Key Risk Facts
27
28	- OSS ACL `public-read-write` exposes all objects immediately to any internet user. Internet crawlers index publicly exposed OSS buckets within seconds to minutes. Reversing the ACL back to private cannot un-index data that was already crawled. This exposure is practically irreversible in its data-leak consequences.
29	- OSS ACL `public-read` makes all objects readable by the internet. Depending on object sensitivity, this may be acceptable for CDN use cases or catastrophic for PII/business data.
30	- *Cross-border replication from CN- to international regions** requires a completed CAC Data Security Law (DSL) Article 31 security assessment. Initiating replication without a completed assessment violates Chinese law.
31	- Bucket policy deletion removes all fine-grained access controls, potentially expanding access to all authenticated Alibaba Cloud users depending on ACL settings.
32	- All mutations require the 6-step live-guard gate.
33
34	## Pre-Flight Checklist
35
36	Before executing any OSS bucket ACL or policy mutation, verify all of the following:
37
38	1. Bucket identity confirmed — confirm the exact bucket name, region, and owner account. Run `aliyun oss stat oss://<BUCKET>` or use the OSS Console to confirm bucket metadata.
39	2. Current ACL and policy captured — document the current bucket ACL and bucket policy before any change. This is the rollback baseline.
40	3. Object sensitivity assessed — estimate the classification and sensitivity of objects stored in this bucket. Public access to PII, credentials, financial records, or internal business data is a critical incident.
41	4. Cross-border replication check — if the bucket is in a CN-* region and replication targets an international region, DSL Article 31 assessment must be completed first.
42	5. Blast radius assessed — how many objects are in scope? what services or users depend on the current access model? what applications will break if access changes?
43	6. Rollback plan confirmed — document the exact prior ACL and policy for immediate restoration if needed.
44
45	## Required Confirmation
46
47	The operator must explicitly state all of the following before any mutation is executed:
48
49	- "I confirm the bucket is `<BUCKET_NAME>` in region `<REGION>` in account `<ACCOUNT_ID>`."
50	- "I have reviewed the current ACL (`<CURRENT_ACL>`) and policy and the proposed change is `<SPECIFIC_CHANGE>`."
51	- "I have assessed the data sensitivity of objects in this bucket: `<ASSESSMENT>`."
52	- "I understand the blast radius of this change: `<DESCRIPTION>`."
53	- For public-read or public-read-write ACL: "I understand that internet crawlers may index exposed data within seconds and that this exposure cannot be reversed for already-crawled data. I accept this risk."
54	- For CN-* cross-border replication: "I confirm a completed DSL Article 31 assessment is on file for this data transfer."
55	- "I approve this OSS bucket ACL/policy change."
56
57	## Execution Steps
58
59	1. Capture pre-change bucket state: `aliyun oss stat oss://<BUCKET>` and policy output.
60	2. Present the planned change, current ACL/policy, and blast radius to the operator for explicit approval.
61	3. Execute the mutation:
62	- Set ACL: `aliyun oss set-acl oss://<BUCKET> <ACL>` or via OSS Console.
63	- Set bucket policy: via OSS Console > Bucket > Permissions > Bucket Policy, or Alibaba Cloud OSS API.
64	- Configure replication: via OSS Console > Bucket > Data

People who liked this also viewed

6 picks

Type

alibaba-live-oss-bucket-policy-guard

17stars3forks

View on GitHub

How to install alibaba-live-oss-bucket-policy-guard?

raishin/vanguard-frontier-agentic/alibaba-live-oss-bucket-policy-guard

$npx -y skills add Raishin/vanguard-frontier-agentic --skill alibaba-live-oss-bucket-policy-guard

Installs into the current project.

Summary

Gate OSS bucket ACL and policy mutations — public-read/write ACL exposes data to internet crawlers within seconds; CN-* cross-border replication requires DSL Article 31 assessment.

Files · 1

View on GitHub

SKILL.md

1	# Alibaba Cloud Live OSS Bucket Policy Guard
2
3	## Purpose
4
5	Act as the guarded live Alibaba Cloud operator for alibaba-live-oss-bucket-policy-guard work. Gate every OSS bucket ACL and policy mutation with a full impact assessment and explicit operator approval. Treat public-read/write ACL changes as immediate, practically irreversible data exposure events.
6
7	## When to Use
8
9	Use this skill when:
10
11	- An OSS bucket ACL is being changed (private → public-read, public-read-write, or any permissive setting)
12	- An OSS bucket policy is being created, modified, or deleted
13	- Cross-region replication rules are being configured or modified for CN-* buckets
14	- Object ownership settings or CORS policies are being changed on production buckets
15	- A bucket lifecycle policy is being modified in ways that affect object access
16	- An operator needs to audit current bucket ACL and policy before a mutation
17
18	## When NOT to Use
19
20	Do not use this skill when:
21
22	- The task is a read-only OSS bucket audit with no mutation intent
23	- The task involves object-level operations (upload, download, delete objects) rather than bucket-level policy changes
24	- The task involves only OSS lifecycle policies that do not affect access control
25
26	## Key Risk Facts
27
28	- OSS ACL `public-read-write` exposes all objects immediately to any internet user. Internet crawlers index publicly exposed OSS buckets within seconds to minutes. Reversing the ACL back to private cannot un-index data that was already crawled. This exposure is practically irreversible in its data-leak consequences.
29	- OSS ACL `public-read` makes all objects readable by the internet. Depending on object sensitivity, this may be acceptable for CDN use cases or catastrophic for PII/business data.
30	- *Cross-border replication from CN- to international regions** requires a completed CAC Data Security Law (DSL) Article 31 security assessment. Initiating replication without a completed assessment violates Chinese law.
31	- Bucket policy deletion removes all fine-grained access controls, potentially expanding access to all authenticated Alibaba Cloud users depending on ACL settings.
32	- All mutations require the 6-step live-guard gate.
33
34	## Pre-Flight Checklist
35
36	Before executing any OSS bucket ACL or policy mutation, verify all of the following:
37
38	1. Bucket identity confirmed — confirm the exact bucket name, region, and owner account. Run `aliyun oss stat oss://<BUCKET>` or use the OSS Console to confirm bucket metadata.
39	2. Current ACL and policy captured — document the current bucket ACL and bucket policy before any change. This is the rollback baseline.
40	3. Object sensitivity assessed — estimate the classification and sensitivity of objects stored in this bucket. Public access to PII, credentials, financial records, or internal business data is a critical incident.
41	4. Cross-border replication check — if the bucket is in a CN-* region and replication targets an international region, DSL Article 31 assessment must be completed first.
42	5. Blast radius assessed — how many objects are in scope? what services or users depend on the current access model? what applications will break if access changes?
43	6. Rollback plan confirmed — document the exact prior ACL and policy for immediate restoration if needed.
44
45	## Required Confirmation
46
47	The operator must explicitly state all of the following before any mutation is executed:
48
49	- "I confirm the bucket is `<BUCKET_NAME>` in region `<REGION>` in account `<ACCOUNT_ID>`."
50	- "I have reviewed the current ACL (`<CURRENT_ACL>`) and policy and the proposed change is `<SPECIFIC_CHANGE>`."
51	- "I have assessed the data sensitivity of objects in this bucket: `<ASSESSMENT>`."
52	- "I understand the blast radius of this change: `<DESCRIPTION>`."
53	- For public-read or public-read-write ACL: "I understand that internet crawlers may index exposed data within seconds and that this exposure cannot be reversed for already-crawled data. I accept this risk."
54	- For CN-* cross-border replication: "I confirm a completed DSL Article 31 assessment is on file for this data transfer."
55	- "I approve this OSS bucket ACL/policy change."
56
57	## Execution Steps
58
59	1. Capture pre-change bucket state: `aliyun oss stat oss://<BUCKET>` and policy output.
60	2. Present the planned change, current ACL/policy, and blast radius to the operator for explicit approval.
61	3. Execute the mutation:
62	- Set ACL: `aliyun oss set-acl oss://<BUCKET> <ACL>` or via OSS Console.
63	- Set bucket policy: via OSS Console > Bucket > Permissions > Bucket Policy, or Alibaba Cloud OSS API.
64	- Configure replication: via OSS Console > Bucket > Data

People who liked this also viewed

6 picks

Type