diff --git a/tuts/198-s3-cors/README.md b/tuts/198-s3-cors/README.md
new file mode 100644
index 0000000..2fb2150
--- /dev/null
+++ b/tuts/198-s3-cors/README.md
@@ -0,0 +1,38 @@
+# S3 Cors
+
+An AWS CLI tutorial that demonstrates S3 operations.
+
+## Running
+
+```bash
+bash s3-cors.sh
+```
+
+To auto-run with cleanup:
+
+```bash
+echo 'y' | bash s3-cors.sh
+```
+
+## What it does
+
+1. Creating bucket"; aws s3api create-bucket --bucket "$B
+2. Setting CORS"; aws s3api put-bucket-cors --bucket "$B" --cors-configuration '{"CORSRules":[{"AllowedOrigins":["https://example.com"],"AllowedMethods":["GET","PUT"],"AllowedHeaders":["*"],"MaxAgeSeconds
+3. Getting CORS"; aws s3api get-bucket-cors --bucket "$B
+
+## Resources created
+
+- Bucket
+- Bucket Cors
+
+The script prompts you to clean up resources when it finishes.
+
+## Cost
+
+Free tier eligible for most operations. Clean up resources after use to avoid charges.
+
+## Related docs
+
+- [AWS CLI s3 reference](https://docs.aws.amazon.com/cli/latest/reference/s3/index.html)
+- [AWS CLI s3api reference](https://docs.aws.amazon.com/cli/latest/reference/s3api/index.html)
+
diff --git a/tuts/198-s3-cors/REVISION-HISTORY.md b/tuts/198-s3-cors/REVISION-HISTORY.md
new file mode 100644
index 0000000..1a6e9a4
--- /dev/null
+++ b/tuts/198-s3-cors/REVISION-HISTORY.md
@@ -0,0 +1,8 @@
+# Revision History: 198-s3-cors
+
+## Shell (CLI script)
+
+### 2026-04-14 v1 published
+- Type: functional
+- Initial version
+
diff --git a/tuts/198-s3-cors/s3-cors.md b/tuts/198-s3-cors/s3-cors.md
new file mode 100644
index 0000000..2c7831c
--- /dev/null
+++ b/tuts/198-s3-cors/s3-cors.md
@@ -0,0 +1,23 @@
+# S3 Cors
+
+## Prerequisites
+
+1. AWS CLI installed and configured (`aws configure`)
+2. Appropriate IAM permissions for the AWS services used
+
+## Step 1: Creating bucket"; aws s3api create-bucket --bucket "$B
+
+The script handles this step automatically. See `s3-cors.sh` for the exact CLI commands.
+
+## Step 2: Setting CORS"; aws s3api put-bucket-cors --bucket "$B" --cors-configuration '{"CORSRules":[{"AllowedOrigins":["https://example.com"],"AllowedMethods":["GET","PUT"],"AllowedHeaders":["*"],"MaxAgeSeconds
+
+The script handles this step automatically. See `s3-cors.sh` for the exact CLI commands.
+
+## Step 3: Getting CORS"; aws s3api get-bucket-cors --bucket "$B
+
+The script handles this step automatically. See `s3-cors.sh` for the exact CLI commands.
+
+## Cleanup
+
+The script prompts you to clean up all created resources. If you need to clean up manually, check the script log for the resource names that were created.
+
diff --git a/tuts/198-s3-cors/s3-cors.sh b/tuts/198-s3-cors/s3-cors.sh
new file mode 100644
index 0000000..0b708f6
--- /dev/null
+++ b/tuts/198-s3-cors/s3-cors.sh
@@ -0,0 +1,9 @@
+#!/bin/bash
+WORK_DIR=$(mktemp -d); exec > >(tee -a "$WORK_DIR/tut.log") 2>&1
+REGION=${AWS_DEFAULT_REGION:-${AWS_REGION:-$(aws configure get region 2>/dev/null))}; [ -z "$REGION" ] && echo "ERROR: No region" && exit 1; export AWS_DEFAULT_REGION="$REGION"; echo "Region: $REGION"
+RANDOM_ID=$(cat /dev/urandom | tr -dc 'a-z0-9' | fold -w 8 | head -n 1); ACCOUNT=$(aws sts get-caller-identity --query Account --output text); B="cors-tut-${RANDOM_ID}-${ACCOUNT}"
+cleanup() { aws s3 rb "s3://$B" 2>/dev/null; rm -rf "$WORK_DIR"; echo "Done."; }
+echo "Step 1: Creating bucket"; aws s3api create-bucket --bucket "$B" > /dev/null
+echo "Step 2: Setting CORS"; aws s3api put-bucket-cors --bucket "$B" --cors-configuration '{"CORSRules":[{"AllowedOrigins":["https://example.com"],"AllowedMethods":["GET","PUT"],"AllowedHeaders":["*"],"MaxAgeSeconds":3600}]}'
+echo "Step 3: Getting CORS"; aws s3api get-bucket-cors --bucket "$B" --query 'CORSRules[0].{Origins:AllowedOrigins,Methods:AllowedMethods}' --output table
+echo "Do you want to clean up? (y/n): "; read -r C; [[ "$C" =~ ^[Yy]$ ]] && cleanup
diff --git a/tuts/202-s3-storage-classes/README.md b/tuts/202-s3-storage-classes/README.md
new file mode 100644
index 0000000..bdf1ca9
--- /dev/null
+++ b/tuts/202-s3-storage-classes/README.md
@@ -0,0 +1,27 @@
+# S3 Storage Classes
+
+A read-only script that queries S3Api resources and displays information.
+
+## Running
+
+```bash
+bash s3-storage-classes.sh
+```
+
+## What it does
+
+1. Listing objects with storage classes
+2. Storage class reference
+
+## Resources created
+
+None — this script is read-only.
+
+## Cost
+
+No cost. This script only reads existing resources.
+
+## Related docs
+
+- [AWS CLI s3api reference](https://docs.aws.amazon.com/cli/latest/reference/s3api/index.html)
+
diff --git a/tuts/202-s3-storage-classes/REVISION-HISTORY.md b/tuts/202-s3-storage-classes/REVISION-HISTORY.md
new file mode 100644
index 0000000..7ccd00d
--- /dev/null
+++ b/tuts/202-s3-storage-classes/REVISION-HISTORY.md
@@ -0,0 +1,8 @@
+# Revision History: 202-s3-storage-classes
+
+## Shell (CLI script)
+
+### 2026-04-14 v1 published
+- Type: functional
+- Initial version
+
diff --git a/tuts/202-s3-storage-classes/s3-storage-classes.md b/tuts/202-s3-storage-classes/s3-storage-classes.md
new file mode 100644
index 0000000..f6635ab
--- /dev/null
+++ b/tuts/202-s3-storage-classes/s3-storage-classes.md
@@ -0,0 +1,15 @@
+# S3 Storage Classes
+
+## Prerequisites
+
+1. AWS CLI installed and configured (`aws configure`)
+2. Appropriate IAM permissions for the AWS services used
+
+## Step 1: Listing objects with storage classes
+
+The script handles this step automatically. See `s3-storage-classes.sh` for the exact CLI commands.
+
+## Step 2: Storage class reference
+
+The script handles this step automatically. See `s3-storage-classes.sh` for the exact CLI commands.
+
diff --git a/tuts/202-s3-storage-classes/s3-storage-classes.sh b/tuts/202-s3-storage-classes/s3-storage-classes.sh
new file mode 100644
index 0000000..1506d89
--- /dev/null
+++ b/tuts/202-s3-storage-classes/s3-storage-classes.sh
@@ -0,0 +1,15 @@
+#!/bin/bash
+WORK_DIR=$(mktemp -d); exec > >(tee -a "$WORK_DIR/tut.log") 2>&1
+REGION=${AWS_DEFAULT_REGION:-${AWS_REGION:-$(aws configure get region 2>/dev/null))}; [ -z "$REGION" ] && echo "ERROR: No region" && exit 1; export AWS_DEFAULT_REGION="$REGION"; echo "Region: $REGION"
+echo "Step 1: Listing objects with storage classes"
+BUCKET=$(aws s3api list-buckets --query 'Buckets[0].Name' --output text)
+[ -n "$BUCKET" ] && [ "$BUCKET" != "None" ] && aws s3api list-objects-v2 --bucket "$BUCKET" --max-keys 10 --query 'Contents[].{Key:Key,Size:Size,Class:StorageClass}' --output table || echo "  No buckets"
+echo "Step 2: Storage class reference"
+echo "  STANDARD: Default, frequently accessed"
+echo "  STANDARD_IA: Infrequent access, lower cost"
+echo "  ONEZONE_IA: Single AZ, lowest IA cost"
+echo "  INTELLIGENT_TIERING: Auto-tiering"
+echo "  GLACIER_IR: Instant retrieval archive"
+echo "  GLACIER: Flexible retrieval (minutes to hours)"
+echo "  DEEP_ARCHIVE: Lowest cost (12-48 hours)"
+echo ""; echo "Tutorial complete. Read-only."; rm -rf "$WORK_DIR"
diff --git a/tuts/206-s3-metrics/README.md b/tuts/206-s3-metrics/README.md
new file mode 100644
index 0000000..081bd90
--- /dev/null
+++ b/tuts/206-s3-metrics/README.md
@@ -0,0 +1,28 @@
+# S3 Metrics
+
+A read-only script that queries Cloudwatch resources and displays information.
+
+## Running
+
+```bash
+bash s3-metrics.sh
+```
+
+## What it does
+
+1. Listing buckets with sizes
+2. Getting bucket metrics (request count)
+
+## Resources created
+
+None — this script is read-only.
+
+## Cost
+
+No cost. This script only reads existing resources.
+
+## Related docs
+
+- [AWS CLI cloudwatch reference](https://docs.aws.amazon.com/cli/latest/reference/cloudwatch/index.html)
+- [AWS CLI s3api reference](https://docs.aws.amazon.com/cli/latest/reference/s3api/index.html)
+
diff --git a/tuts/206-s3-metrics/REVISION-HISTORY.md b/tuts/206-s3-metrics/REVISION-HISTORY.md
new file mode 100644
index 0000000..5be8de4
--- /dev/null
+++ b/tuts/206-s3-metrics/REVISION-HISTORY.md
@@ -0,0 +1,8 @@
+# Revision History: 206-s3-metrics
+
+## Shell (CLI script)
+
+### 2026-04-14 v1 published
+- Type: functional
+- Initial version
+
diff --git a/tuts/206-s3-metrics/s3-metrics.md b/tuts/206-s3-metrics/s3-metrics.md
new file mode 100644
index 0000000..cc70262
--- /dev/null
+++ b/tuts/206-s3-metrics/s3-metrics.md
@@ -0,0 +1,15 @@
+# S3 Metrics
+
+## Prerequisites
+
+1. AWS CLI installed and configured (`aws configure`)
+2. Appropriate IAM permissions for the AWS services used
+
+## Step 1: Listing buckets with sizes
+
+The script handles this step automatically. See `s3-metrics.sh` for the exact CLI commands.
+
+## Step 2: Getting bucket metrics (request count)
+
+The script handles this step automatically. See `s3-metrics.sh` for the exact CLI commands.
+
diff --git a/tuts/206-s3-metrics/s3-metrics.sh b/tuts/206-s3-metrics/s3-metrics.sh
new file mode 100644
index 0000000..f13b177
--- /dev/null
+++ b/tuts/206-s3-metrics/s3-metrics.sh
@@ -0,0 +1,9 @@
+#!/bin/bash
+WORK_DIR=$(mktemp -d); exec > >(tee -a "$WORK_DIR/tut.log") 2>&1
+REGION=${AWS_DEFAULT_REGION:-${AWS_REGION:-$(aws configure get region 2>/dev/null))}; [ -z "$REGION" ] && echo "ERROR: No region" && exit 1; export AWS_DEFAULT_REGION="$REGION"; echo "Region: $REGION"
+echo "Step 1: Listing buckets with sizes"
+aws s3api list-buckets --query 'Buckets[:10].{Name:Name,Created:CreationDate}' --output table
+echo "Step 2: Getting bucket metrics (request count)"
+B=$(aws s3api list-buckets --query 'Buckets[0].Name' --output text)
+[ -n "$B" ] && [ "$B" != "None" ] && aws cloudwatch get-metric-statistics --namespace AWS/S3 --metric-name NumberOfObjects --dimensions Name=BucketName,Value="$B" Name=StorageType,Value=AllStorageTypes --start-time "$(date -u -d '2 days ago' +%Y-%m-%dT%H:%M:%SZ)" --end-time "$(date -u +%Y-%m-%dT%H:%M:%SZ)" --period 86400 --statistics Average --query 'Datapoints[0].Average' --output text 2>/dev/null || echo "  No metrics"
+echo ""; echo "Tutorial complete. Read-only."; rm -rf "$WORK_DIR"
diff --git a/tuts/209-s3-list-buckets/README.md b/tuts/209-s3-list-buckets/README.md
new file mode 100644
index 0000000..26bacb4
--- /dev/null
+++ b/tuts/209-s3-list-buckets/README.md
@@ -0,0 +1,28 @@
+# S3 List Buckets
+
+A read-only script that queries S3Api resources and displays information.
+
+## Running
+
+```bash
+bash s3-list-buckets.sh
+```
+
+## What it does
+
+1. Listing all buckets
+2. Bucket count"; echo "  Total: $(aws s3api list-buckets --query 'Buckets | length(@)' --output text) buckets
+3. Checking public access block"; B=$(aws s3api list-buckets --query 'Buckets[0].Name' --output text); [ -n "$B" ] && [ "$B" != "None" ] && aws s3api get-public-access-block --bucket "$B" --query 'PublicAccessBlockConfiguration' --output table 2>/dev/null || echo "  No public access block
+
+## Resources created
+
+None — this script is read-only.
+
+## Cost
+
+No cost. This script only reads existing resources.
+
+## Related docs
+
+- [AWS CLI s3api reference](https://docs.aws.amazon.com/cli/latest/reference/s3api/index.html)
+
diff --git a/tuts/209-s3-list-buckets/REVISION-HISTORY.md b/tuts/209-s3-list-buckets/REVISION-HISTORY.md
new file mode 100644
index 0000000..bd9dc5e
--- /dev/null
+++ b/tuts/209-s3-list-buckets/REVISION-HISTORY.md
@@ -0,0 +1,8 @@
+# Revision History: 209-s3-list-buckets
+
+## Shell (CLI script)
+
+### 2026-04-14 v1 published
+- Type: functional
+- Initial version
+
diff --git a/tuts/209-s3-list-buckets/s3-list-buckets.md b/tuts/209-s3-list-buckets/s3-list-buckets.md
new file mode 100644
index 0000000..9b33dba
--- /dev/null
+++ b/tuts/209-s3-list-buckets/s3-list-buckets.md
@@ -0,0 +1,19 @@
+# S3 List Buckets
+
+## Prerequisites
+
+1. AWS CLI installed and configured (`aws configure`)
+2. Appropriate IAM permissions for the AWS services used
+
+## Step 1: Listing all buckets
+
+The script handles this step automatically. See `s3-list-buckets.sh` for the exact CLI commands.
+
+## Step 2: Bucket count"; echo "  Total: $(aws s3api list-buckets --query 'Buckets | length(@)' --output text) buckets
+
+The script handles this step automatically. See `s3-list-buckets.sh` for the exact CLI commands.
+
+## Step 3: Checking public access block"; B=$(aws s3api list-buckets --query 'Buckets[0].Name' --output text); [ -n "$B" ] && [ "$B" != "None" ] && aws s3api get-public-access-block --bucket "$B" --query 'PublicAccessBlockConfiguration' --output table 2>/dev/null || echo "  No public access block
+
+The script handles this step automatically. See `s3-list-buckets.sh` for the exact CLI commands.
+
diff --git a/tuts/209-s3-list-buckets/s3-list-buckets.sh b/tuts/209-s3-list-buckets/s3-list-buckets.sh
new file mode 100644
index 0000000..ebdfeb6
--- /dev/null
+++ b/tuts/209-s3-list-buckets/s3-list-buckets.sh
@@ -0,0 +1,7 @@
+#!/bin/bash
+WORK_DIR=$(mktemp -d); exec > >(tee -a "$WORK_DIR/tut.log") 2>&1
+REGION=${AWS_DEFAULT_REGION:-${AWS_REGION:-$(aws configure get region 2>/dev/null))}; [ -z "$REGION" ] && echo "ERROR: No region" && exit 1; export AWS_DEFAULT_REGION="$REGION"; echo "Region: $REGION"
+echo "Step 1: Listing all buckets"; aws s3api list-buckets --query 'Buckets[].{Name:Name,Created:CreationDate}' --output table
+echo "Step 2: Bucket count"; echo "  Total: $(aws s3api list-buckets --query 'Buckets | length(@)' --output text) buckets"
+echo "Step 3: Checking public access block"; B=$(aws s3api list-buckets --query 'Buckets[0].Name' --output text); [ -n "$B" ] && [ "$B" != "None" ] && aws s3api get-public-access-block --bucket "$B" --query 'PublicAccessBlockConfiguration' --output table 2>/dev/null || echo "  No public access block"
+echo ""; echo "Tutorial complete. Read-only."; rm -rf "$WORK_DIR"
diff --git a/tuts/214-s3-bucket-tagging/README.md b/tuts/214-s3-bucket-tagging/README.md
new file mode 100644
index 0000000..92192b2
--- /dev/null
+++ b/tuts/214-s3-bucket-tagging/README.md
@@ -0,0 +1,39 @@
+# S3 Bucket Tagging
+
+An AWS CLI tutorial that demonstrates S3 operations.
+
+## Running
+
+```bash
+bash s3-bucket-tagging.sh
+```
+
+To auto-run with cleanup:
+
+```bash
+echo 'y' | bash s3-bucket-tagging.sh
+```
+
+## What it does
+
+1. Creating bucket"; aws s3api create-bucket --bucket "$B
+2. Adding tags"; aws s3api put-bucket-tagging --bucket "$B
+3. Getting tags"; aws s3api get-bucket-tagging --bucket "$B
+4. Deleting tags"; aws s3api delete-bucket-tagging --bucket "$B"; echo "  Tags deleted
+
+## Resources created
+
+- Bucket
+- Bucket Tagging
+
+The script prompts you to clean up resources when it finishes.
+
+## Cost
+
+Free tier eligible for most operations. Clean up resources after use to avoid charges.
+
+## Related docs
+
+- [AWS CLI s3 reference](https://docs.aws.amazon.com/cli/latest/reference/s3/index.html)
+- [AWS CLI s3api reference](https://docs.aws.amazon.com/cli/latest/reference/s3api/index.html)
+
diff --git a/tuts/214-s3-bucket-tagging/REVISION-HISTORY.md b/tuts/214-s3-bucket-tagging/REVISION-HISTORY.md
new file mode 100644
index 0000000..8b8865e
--- /dev/null
+++ b/tuts/214-s3-bucket-tagging/REVISION-HISTORY.md
@@ -0,0 +1,8 @@
+# Revision History: 214-s3-bucket-tagging
+
+## Shell (CLI script)
+
+### 2026-04-14 v1 published
+- Type: functional
+- Initial version
+
diff --git a/tuts/214-s3-bucket-tagging/s3-bucket-tagging.md b/tuts/214-s3-bucket-tagging/s3-bucket-tagging.md
new file mode 100644
index 0000000..282f9b0
--- /dev/null
+++ b/tuts/214-s3-bucket-tagging/s3-bucket-tagging.md
@@ -0,0 +1,27 @@
+# S3 Bucket Tagging
+
+## Prerequisites
+
+1. AWS CLI installed and configured (`aws configure`)
+2. Appropriate IAM permissions for the AWS services used
+
+## Step 1: Creating bucket"; aws s3api create-bucket --bucket "$B
+
+The script handles this step automatically. See `s3-bucket-tagging.sh` for the exact CLI commands.
+
+## Step 2: Adding tags"; aws s3api put-bucket-tagging --bucket "$B
+
+The script handles this step automatically. See `s3-bucket-tagging.sh` for the exact CLI commands.
+
+## Step 3: Getting tags"; aws s3api get-bucket-tagging --bucket "$B
+
+The script handles this step automatically. See `s3-bucket-tagging.sh` for the exact CLI commands.
+
+## Step 4: Deleting tags"; aws s3api delete-bucket-tagging --bucket "$B"; echo "  Tags deleted
+
+The script handles this step automatically. See `s3-bucket-tagging.sh` for the exact CLI commands.
+
+## Cleanup
+
+The script prompts you to clean up all created resources. If you need to clean up manually, check the script log for the resource names that were created.
+
diff --git a/tuts/214-s3-bucket-tagging/s3-bucket-tagging.sh b/tuts/214-s3-bucket-tagging/s3-bucket-tagging.sh
new file mode 100644
index 0000000..bb45ae8
--- /dev/null
+++ b/tuts/214-s3-bucket-tagging/s3-bucket-tagging.sh
@@ -0,0 +1,10 @@
+#!/bin/bash
+WORK_DIR=$(mktemp -d); exec > >(tee -a "$WORK_DIR/tut.log") 2>&1
+REGION=${AWS_DEFAULT_REGION:-${AWS_REGION:-$(aws configure get region 2>/dev/null))}; [ -z "$REGION" ] && echo "ERROR: No region" && exit 1; export AWS_DEFAULT_REGION="$REGION"; echo "Region: $REGION"
+RANDOM_ID=$(cat /dev/urandom | tr -dc 'a-z0-9' | fold -w 8 | head -n 1); ACCOUNT=$(aws sts get-caller-identity --query Account --output text); B="tag-tut-${RANDOM_ID}-${ACCOUNT}"
+cleanup() { aws s3 rb "s3://$B" 2>/dev/null; rm -rf "$WORK_DIR"; echo "Done."; }
+echo "Step 1: Creating bucket"; aws s3api create-bucket --bucket "$B" > /dev/null
+echo "Step 2: Adding tags"; aws s3api put-bucket-tagging --bucket "$B" --tagging 'TagSet=[{Key=Environment,Value=tutorial},{Key=Project,Value=tagging-demo},{Key=Owner,Value=tutorial-user}]'
+echo "Step 3: Getting tags"; aws s3api get-bucket-tagging --bucket "$B" --query 'TagSet[].{Key:Key,Value:Value}' --output table
+echo "Step 4: Deleting tags"; aws s3api delete-bucket-tagging --bucket "$B"; echo "  Tags deleted"
+echo "Do you want to clean up? (y/n): "; read -r C; [[ "$C" =~ ^[Yy]$ ]] && cleanup