Daily Amazon S3 bucket activity digest in Slack
Every weekday at 9am, get a grouped Slack summary of what changed in your S3 bucket overnight, with counts, notable files, and anomalies flagged.
Amazon S3
SlackOperationsEngineeringDaily DigestsNotifications & AlertsEvery weekday at 9am, scan a specific Amazon S3 bucket for objects created or modified in the trailing 24 hours and post a grouped digest to Slack. The trigger is cron; there is no live event stream, since S3 only emits to SNS, SQS, or EventBridge rather than outgoing webhooks, and a morning summary is how ops teams actually want to consume this.
Use Amazon S3's List Objects (V2) operation against the configured bucket. If the user provides a prefix scope, pass it as the Prefix parameter. Paginate through results (up to 1,000 keys per page) and keep only the objects whose LastModified falls within the last 24 hours of the run.
Group the matching keys by their top-level folder (the segment before the first slash in the key; use "(root)" for keys with no prefix). Track counts per folder and the largest files per folder.
For any file that looks unusual, call Amazon S3's Head Object operation to fetch full metadata (size, content type, ETag, last modified). "Unusual" means the file exceeds the configurable notable-size threshold, has a file extension that hasn't appeared in the bucket before, or is missing an expected content type. Head Object is only for the small set of flagged files, not every result.
Look for anomalies worth calling out in the digest: a top-level folder that usually receives a nightly file but is empty today (missing backup), a single upload that is dramatically larger than the recent average, a new top-level folder appearing for the first time, or a folder whose file count jumped or dropped versus the recent baseline. Use judgement about what actually matters; do not spam the summary with borderline observations.
Format a Slack message with: the total object count from the last 24 hours, a per-folder breakdown with counts, up to a handful of notable files with their size and type, and an Anomalies section listing anything flagged. Keep it scannable — headers and short bullets, not paragraphs. Post it with Slack's Send a Message operation to the channel the user configured.
User-configurable inputs: the bucket name, an optional prefix scope (leave blank to scan the whole bucket), the notable-file size threshold in megabytes (default 100), and the Slack channel to post to. If there was no activity in the last 24 hours, still post a short "nothing changed overnight" message so the team knows the workflow ran.
Additional information
What does this prompt do?
- Runs every weekday morning and checks what changed in your S3 bucket overnight.
- Groups new and updated files by folder so you see activity at a glance.
- Flags oversized files, unusual types, missing nightly backups, and brand-new folders.
- Posts the whole summary as one tidy Slack message to a channel you choose.
What do I need to use this?
- An Amazon S3 account with access to the bucket you want to watch.
- A Slack workspace and a channel where the digest should land.
- A rough sense of what a large upload looks like for your team, used as the notable-file threshold.
How can I customize it?
- Change the schedule to run daily, weekdays only, or twice a day.
- Point it at a specific folder path if you only care about one part of the bucket.
- Raise or lower the notable-file size threshold to match your workload.
- Swap the Slack channel to a different team channel or the on-call room.
Frequently asked questions
Does this work on any S3 bucket, or only ones I own?
Why a morning digest instead of a real-time ping for every file?
What counts as an anomaly worth flagging?
Will it read the contents of my files?
Can I send the digest to more than one channel?
Related templates
Stop guessing what changed in your S3 bucket overnight.
Set the digest up once and get a clean, grouped morning summary in Slack every workday.