Daily Amazon S3 bucket activity digest in Slack

Every weekday at 9am, scan a specific Amazon S3 bucket for objects created or modified in the trailing 24 hours and post a grouped digest to Slack. The trigger is cron; there is no live event stream, since S3 only emits to SNS, SQS, or EventBridge rather than outgoing webhooks, and a morning summary is how ops teams actually want to consume this.

Use Amazon S3's List Objects (V2) operation against the configured bucket. If the user provides a prefix scope, pass it as the Prefix parameter. Paginate through results (up to 1,000 keys per page) and keep only the objects whose LastModified falls within the last 24 hours of the run.

Group the matching keys by their top-level folder (the segment before the first slash in the key; use "(root)" for keys with no prefix). Track counts per folder and the largest files per folder.

For any file that looks unusual, call Amazon S3's Head Object operation to fetch full metadata (size, content type, ETag, last modified). "Unusual" means the file exceeds the configurable notable-size threshold, has a file extension that hasn't appeared in the bucket before, or is missing an expected content type. Head Object is only for the small set of flagged files, not every result.

Look for anomalies worth calling out in the digest: a top-level folder that usually receives a nightly file but is empty today (missing backup), a single upload that is dramatically larger than the recent average, a new top-level folder appearing for the first time, or a folder whose file count jumped or dropped versus the recent baseline. Use judgement about what actually matters; do not spam the summary with borderline observations.

Format a Slack message with: the total object count from the last 24 hours, a per-folder breakdown with counts, up to a handful of notable files with their size and type, and an Anomalies section listing anything flagged. Keep it scannable — headers and short bullets, not paragraphs. Post it with Slack's Send a Message operation to the channel the user configured.

User-configurable inputs: the bucket name, an optional prefix scope (leave blank to scan the whole bucket), the notable-file size threshold in megabytes (default 100), and the Slack channel to post to. If there was no activity in the last 24 hours, still post a short "nothing changed overnight" message so the team knows the workflow ran.