From 2fb670f96bd55769d846df153fc0ecfd68035007 Mon Sep 17 00:00:00 2001
From: Michael Wunderlich <mwunderl@amazon.com>
Date: Tue, 14 Apr 2026 16:35:00 +0000
Subject: [PATCH 1/3] Add storage tutorials (batch 9)

---
 tuts/198-s3-cors/s3-cors.sh                       |  9 +++++++++
 tuts/202-s3-storage-classes/s3-storage-classes.sh | 15 +++++++++++++++
 tuts/206-s3-metrics/s3-metrics.sh                 |  9 +++++++++
 tuts/209-s3-list-buckets/s3-list-buckets.sh       |  7 +++++++
 tuts/214-s3-bucket-tagging/s3-bucket-tagging.sh   | 10 ++++++++++
 5 files changed, 50 insertions(+)
 create mode 100644 tuts/198-s3-cors/s3-cors.sh
 create mode 100644 tuts/202-s3-storage-classes/s3-storage-classes.sh
 create mode 100644 tuts/206-s3-metrics/s3-metrics.sh
 create mode 100644 tuts/209-s3-list-buckets/s3-list-buckets.sh
 create mode 100644 tuts/214-s3-bucket-tagging/s3-bucket-tagging.sh

diff --git a/tuts/198-s3-cors/s3-cors.sh b/tuts/198-s3-cors/s3-cors.sh
new file mode 100644
index 00000000..ff8dc2fc
--- /dev/null
+++ b/tuts/198-s3-cors/s3-cors.sh
@@ -0,0 +1,9 @@
+#!/bin/bash
+WORK_DIR=$(mktemp -d); exec > >(tee -a "$WORK_DIR/tut.log") 2>&1
+REGION=${AWS_DEFAULT_REGION:-$(aws configure get region 2>/dev/null)}; [ -z "$REGION" ] && echo "ERROR: No region" && exit 1; export AWS_DEFAULT_REGION="$REGION"; echo "Region: $REGION"
+RANDOM_ID=$(openssl rand -hex 4); ACCOUNT=$(aws sts get-caller-identity --query Account --output text); B="cors-tut-${RANDOM_ID}-${ACCOUNT}"
+cleanup() { aws s3 rb "s3://$B" 2>/dev/null; rm -rf "$WORK_DIR"; echo "Done."; }
+echo "Step 1: Creating bucket"; aws s3api create-bucket --bucket "$B" > /dev/null
+echo "Step 2: Setting CORS"; aws s3api put-bucket-cors --bucket "$B" --cors-configuration '{"CORSRules":[{"AllowedOrigins":["https://example.com"],"AllowedMethods":["GET","PUT"],"AllowedHeaders":["*"],"MaxAgeSeconds":3600}]}'
+echo "Step 3: Getting CORS"; aws s3api get-bucket-cors --bucket "$B" --query 'CORSRules[0].{Origins:AllowedOrigins,Methods:AllowedMethods}' --output table
+echo "Do you want to clean up? (y/n): "; read -r C; [[ "$C" =~ ^[Yy]$ ]] && cleanup
diff --git a/tuts/202-s3-storage-classes/s3-storage-classes.sh b/tuts/202-s3-storage-classes/s3-storage-classes.sh
new file mode 100644
index 00000000..04801784
--- /dev/null
+++ b/tuts/202-s3-storage-classes/s3-storage-classes.sh
@@ -0,0 +1,15 @@
+#!/bin/bash
+WORK_DIR=$(mktemp -d); exec > >(tee -a "$WORK_DIR/tut.log") 2>&1
+REGION=${AWS_DEFAULT_REGION:-$(aws configure get region 2>/dev/null)}; [ -z "$REGION" ] && echo "ERROR: No region" && exit 1; export AWS_DEFAULT_REGION="$REGION"; echo "Region: $REGION"
+echo "Step 1: Listing objects with storage classes"
+BUCKET=$(aws s3api list-buckets --query 'Buckets[0].Name' --output text)
+[ -n "$BUCKET" ] && [ "$BUCKET" != "None" ] && aws s3api list-objects-v2 --bucket "$BUCKET" --max-keys 10 --query 'Contents[].{Key:Key,Size:Size,Class:StorageClass}' --output table || echo "  No buckets"
+echo "Step 2: Storage class reference"
+echo "  STANDARD: Default, frequently accessed"
+echo "  STANDARD_IA: Infrequent access, lower cost"
+echo "  ONEZONE_IA: Single AZ, lowest IA cost"
+echo "  INTELLIGENT_TIERING: Auto-tiering"
+echo "  GLACIER_IR: Instant retrieval archive"
+echo "  GLACIER: Flexible retrieval (minutes to hours)"
+echo "  DEEP_ARCHIVE: Lowest cost (12-48 hours)"
+echo ""; echo "Tutorial complete. Read-only."; rm -rf "$WORK_DIR"
diff --git a/tuts/206-s3-metrics/s3-metrics.sh b/tuts/206-s3-metrics/s3-metrics.sh
new file mode 100644
index 00000000..cd55de8d
--- /dev/null
+++ b/tuts/206-s3-metrics/s3-metrics.sh
@@ -0,0 +1,9 @@
+#!/bin/bash
+WORK_DIR=$(mktemp -d); exec > >(tee -a "$WORK_DIR/tut.log") 2>&1
+REGION=${AWS_DEFAULT_REGION:-$(aws configure get region 2>/dev/null)}; [ -z "$REGION" ] && echo "ERROR: No region" && exit 1; export AWS_DEFAULT_REGION="$REGION"; echo "Region: $REGION"
+echo "Step 1: Listing buckets with sizes"
+aws s3api list-buckets --query 'Buckets[:10].{Name:Name,Created:CreationDate}' --output table
+echo "Step 2: Getting bucket metrics (request count)"
+B=$(aws s3api list-buckets --query 'Buckets[0].Name' --output text)
+[ -n "$B" ] && [ "$B" != "None" ] && aws cloudwatch get-metric-statistics --namespace AWS/S3 --metric-name NumberOfObjects --dimensions Name=BucketName,Value="$B" Name=StorageType,Value=AllStorageTypes --start-time "$(date -u -d '2 days ago' +%Y-%m-%dT%H:%M:%SZ)" --end-time "$(date -u +%Y-%m-%dT%H:%M:%SZ)" --period 86400 --statistics Average --query 'Datapoints[0].Average' --output text 2>/dev/null || echo "  No metrics"
+echo ""; echo "Tutorial complete. Read-only."; rm -rf "$WORK_DIR"
diff --git a/tuts/209-s3-list-buckets/s3-list-buckets.sh b/tuts/209-s3-list-buckets/s3-list-buckets.sh
new file mode 100644
index 00000000..a77d1c4d
--- /dev/null
+++ b/tuts/209-s3-list-buckets/s3-list-buckets.sh
@@ -0,0 +1,7 @@
+#!/bin/bash
+WORK_DIR=$(mktemp -d); exec > >(tee -a "$WORK_DIR/tut.log") 2>&1
+REGION=${AWS_DEFAULT_REGION:-$(aws configure get region 2>/dev/null)}; [ -z "$REGION" ] && echo "ERROR: No region" && exit 1; export AWS_DEFAULT_REGION="$REGION"; echo "Region: $REGION"
+echo "Step 1: Listing all buckets"; aws s3api list-buckets --query 'Buckets[].{Name:Name,Created:CreationDate}' --output table
+echo "Step 2: Bucket count"; echo "  Total: $(aws s3api list-buckets --query 'Buckets | length(@)' --output text) buckets"
+echo "Step 3: Checking public access block"; B=$(aws s3api list-buckets --query 'Buckets[0].Name' --output text); [ -n "$B" ] && [ "$B" != "None" ] && aws s3api get-public-access-block --bucket "$B" --query 'PublicAccessBlockConfiguration' --output table 2>/dev/null || echo "  No public access block"
+echo ""; echo "Tutorial complete. Read-only."; rm -rf "$WORK_DIR"
diff --git a/tuts/214-s3-bucket-tagging/s3-bucket-tagging.sh b/tuts/214-s3-bucket-tagging/s3-bucket-tagging.sh
new file mode 100644
index 00000000..45b92f83
--- /dev/null
+++ b/tuts/214-s3-bucket-tagging/s3-bucket-tagging.sh
@@ -0,0 +1,10 @@
+#!/bin/bash
+WORK_DIR=$(mktemp -d); exec > >(tee -a "$WORK_DIR/tut.log") 2>&1
+REGION=${AWS_DEFAULT_REGION:-$(aws configure get region 2>/dev/null)}; [ -z "$REGION" ] && echo "ERROR: No region" && exit 1; export AWS_DEFAULT_REGION="$REGION"; echo "Region: $REGION"
+RANDOM_ID=$(openssl rand -hex 4); ACCOUNT=$(aws sts get-caller-identity --query Account --output text); B="tag-tut-${RANDOM_ID}-${ACCOUNT}"
+cleanup() { aws s3 rb "s3://$B" 2>/dev/null; rm -rf "$WORK_DIR"; echo "Done."; }
+echo "Step 1: Creating bucket"; aws s3api create-bucket --bucket "$B" > /dev/null
+echo "Step 2: Adding tags"; aws s3api put-bucket-tagging --bucket "$B" --tagging 'TagSet=[{Key=Environment,Value=tutorial},{Key=Project,Value=tagging-demo},{Key=Owner,Value=tutorial-user}]'
+echo "Step 3: Getting tags"; aws s3api get-bucket-tagging --bucket "$B" --query 'TagSet[].{Key:Key,Value:Value}' --output table
+echo "Step 4: Deleting tags"; aws s3api delete-bucket-tagging --bucket "$B"; echo "  Tags deleted"
+echo "Do you want to clean up? (y/n): "; read -r C; [[ "$C" =~ ^[Yy]$ ]] && cleanup

From de3f38e08c46e19d4a194a9b0fbcba763e9c9f32 Mon Sep 17 00:00:00 2001
From: Michael Wunderlich <mwunderl@amazon.com>
Date: Tue, 21 Apr 2026 05:17:17 +0000
Subject: [PATCH 2/3] Apply technical requirements (R1, R2, R9, R10, R13)

- R1: Add AWS_REGION to region fallback chain
- R2: Replace openssl rand with /dev/urandom
- R9: Remove Appendix/Generation details from READMEs
- R10: Remove internal references
- R13: Add REVISION-HISTORY.md
---
 tuts/198-s3-cors/REVISION-HISTORY.md              | 8 ++++++++
 tuts/198-s3-cors/s3-cors.sh                       | 4 ++--
 tuts/202-s3-storage-classes/REVISION-HISTORY.md   | 8 ++++++++
 tuts/202-s3-storage-classes/s3-storage-classes.sh | 2 +-
 tuts/206-s3-metrics/REVISION-HISTORY.md           | 8 ++++++++
 tuts/206-s3-metrics/s3-metrics.sh                 | 2 +-
 tuts/209-s3-list-buckets/REVISION-HISTORY.md      | 8 ++++++++
 tuts/209-s3-list-buckets/s3-list-buckets.sh       | 2 +-
 tuts/214-s3-bucket-tagging/REVISION-HISTORY.md    | 8 ++++++++
 tuts/214-s3-bucket-tagging/s3-bucket-tagging.sh   | 4 ++--
 10 files changed, 47 insertions(+), 7 deletions(-)
 create mode 100644 tuts/198-s3-cors/REVISION-HISTORY.md
 create mode 100644 tuts/202-s3-storage-classes/REVISION-HISTORY.md
 create mode 100644 tuts/206-s3-metrics/REVISION-HISTORY.md
 create mode 100644 tuts/209-s3-list-buckets/REVISION-HISTORY.md
 create mode 100644 tuts/214-s3-bucket-tagging/REVISION-HISTORY.md

diff --git a/tuts/198-s3-cors/REVISION-HISTORY.md b/tuts/198-s3-cors/REVISION-HISTORY.md
new file mode 100644
index 00000000..1a6e9a47
--- /dev/null
+++ b/tuts/198-s3-cors/REVISION-HISTORY.md
@@ -0,0 +1,8 @@
+# Revision History: 198-s3-cors
+
+## Shell (CLI script)
+
+### 2026-04-14 v1 published
+- Type: functional
+- Initial version
+
diff --git a/tuts/198-s3-cors/s3-cors.sh b/tuts/198-s3-cors/s3-cors.sh
index ff8dc2fc..0b708f65 100644
--- a/tuts/198-s3-cors/s3-cors.sh
+++ b/tuts/198-s3-cors/s3-cors.sh
@@ -1,7 +1,7 @@
 #!/bin/bash
 WORK_DIR=$(mktemp -d); exec > >(tee -a "$WORK_DIR/tut.log") 2>&1
-REGION=${AWS_DEFAULT_REGION:-$(aws configure get region 2>/dev/null)}; [ -z "$REGION" ] && echo "ERROR: No region" && exit 1; export AWS_DEFAULT_REGION="$REGION"; echo "Region: $REGION"
-RANDOM_ID=$(openssl rand -hex 4); ACCOUNT=$(aws sts get-caller-identity --query Account --output text); B="cors-tut-${RANDOM_ID}-${ACCOUNT}"
+REGION=${AWS_DEFAULT_REGION:-${AWS_REGION:-$(aws configure get region 2>/dev/null))}; [ -z "$REGION" ] && echo "ERROR: No region" && exit 1; export AWS_DEFAULT_REGION="$REGION"; echo "Region: $REGION"
+RANDOM_ID=$(cat /dev/urandom | tr -dc 'a-z0-9' | fold -w 8 | head -n 1); ACCOUNT=$(aws sts get-caller-identity --query Account --output text); B="cors-tut-${RANDOM_ID}-${ACCOUNT}"
 cleanup() { aws s3 rb "s3://$B" 2>/dev/null; rm -rf "$WORK_DIR"; echo "Done."; }
 echo "Step 1: Creating bucket"; aws s3api create-bucket --bucket "$B" > /dev/null
 echo "Step 2: Setting CORS"; aws s3api put-bucket-cors --bucket "$B" --cors-configuration '{"CORSRules":[{"AllowedOrigins":["https://example.com"],"AllowedMethods":["GET","PUT"],"AllowedHeaders":["*"],"MaxAgeSeconds":3600}]}'
diff --git a/tuts/202-s3-storage-classes/REVISION-HISTORY.md b/tuts/202-s3-storage-classes/REVISION-HISTORY.md
new file mode 100644
index 00000000..7ccd00d7
--- /dev/null
+++ b/tuts/202-s3-storage-classes/REVISION-HISTORY.md
@@ -0,0 +1,8 @@
+# Revision History: 202-s3-storage-classes
+
+## Shell (CLI script)
+
+### 2026-04-14 v1 published
+- Type: functional
+- Initial version
+
diff --git a/tuts/202-s3-storage-classes/s3-storage-classes.sh b/tuts/202-s3-storage-classes/s3-storage-classes.sh
index 04801784..1506d899 100644
--- a/tuts/202-s3-storage-classes/s3-storage-classes.sh
+++ b/tuts/202-s3-storage-classes/s3-storage-classes.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 WORK_DIR=$(mktemp -d); exec > >(tee -a "$WORK_DIR/tut.log") 2>&1
-REGION=${AWS_DEFAULT_REGION:-$(aws configure get region 2>/dev/null)}; [ -z "$REGION" ] && echo "ERROR: No region" && exit 1; export AWS_DEFAULT_REGION="$REGION"; echo "Region: $REGION"
+REGION=${AWS_DEFAULT_REGION:-${AWS_REGION:-$(aws configure get region 2>/dev/null))}; [ -z "$REGION" ] && echo "ERROR: No region" && exit 1; export AWS_DEFAULT_REGION="$REGION"; echo "Region: $REGION"
 echo "Step 1: Listing objects with storage classes"
 BUCKET=$(aws s3api list-buckets --query 'Buckets[0].Name' --output text)
 [ -n "$BUCKET" ] && [ "$BUCKET" != "None" ] && aws s3api list-objects-v2 --bucket "$BUCKET" --max-keys 10 --query 'Contents[].{Key:Key,Size:Size,Class:StorageClass}' --output table || echo "  No buckets"
diff --git a/tuts/206-s3-metrics/REVISION-HISTORY.md b/tuts/206-s3-metrics/REVISION-HISTORY.md
new file mode 100644
index 00000000..5be8de46
--- /dev/null
+++ b/tuts/206-s3-metrics/REVISION-HISTORY.md
@@ -0,0 +1,8 @@
+# Revision History: 206-s3-metrics
+
+## Shell (CLI script)
+
+### 2026-04-14 v1 published
+- Type: functional
+- Initial version
+
diff --git a/tuts/206-s3-metrics/s3-metrics.sh b/tuts/206-s3-metrics/s3-metrics.sh
index cd55de8d..f13b177d 100644
--- a/tuts/206-s3-metrics/s3-metrics.sh
+++ b/tuts/206-s3-metrics/s3-metrics.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 WORK_DIR=$(mktemp -d); exec > >(tee -a "$WORK_DIR/tut.log") 2>&1
-REGION=${AWS_DEFAULT_REGION:-$(aws configure get region 2>/dev/null)}; [ -z "$REGION" ] && echo "ERROR: No region" && exit 1; export AWS_DEFAULT_REGION="$REGION"; echo "Region: $REGION"
+REGION=${AWS_DEFAULT_REGION:-${AWS_REGION:-$(aws configure get region 2>/dev/null))}; [ -z "$REGION" ] && echo "ERROR: No region" && exit 1; export AWS_DEFAULT_REGION="$REGION"; echo "Region: $REGION"
 echo "Step 1: Listing buckets with sizes"
 aws s3api list-buckets --query 'Buckets[:10].{Name:Name,Created:CreationDate}' --output table
 echo "Step 2: Getting bucket metrics (request count)"
diff --git a/tuts/209-s3-list-buckets/REVISION-HISTORY.md b/tuts/209-s3-list-buckets/REVISION-HISTORY.md
new file mode 100644
index 00000000..bd9dc5e9
--- /dev/null
+++ b/tuts/209-s3-list-buckets/REVISION-HISTORY.md
@@ -0,0 +1,8 @@
+# Revision History: 209-s3-list-buckets
+
+## Shell (CLI script)
+
+### 2026-04-14 v1 published
+- Type: functional
+- Initial version
+
diff --git a/tuts/209-s3-list-buckets/s3-list-buckets.sh b/tuts/209-s3-list-buckets/s3-list-buckets.sh
index a77d1c4d..ebdfeb6e 100644
--- a/tuts/209-s3-list-buckets/s3-list-buckets.sh
+++ b/tuts/209-s3-list-buckets/s3-list-buckets.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 WORK_DIR=$(mktemp -d); exec > >(tee -a "$WORK_DIR/tut.log") 2>&1
-REGION=${AWS_DEFAULT_REGION:-$(aws configure get region 2>/dev/null)}; [ -z "$REGION" ] && echo "ERROR: No region" && exit 1; export AWS_DEFAULT_REGION="$REGION"; echo "Region: $REGION"
+REGION=${AWS_DEFAULT_REGION:-${AWS_REGION:-$(aws configure get region 2>/dev/null))}; [ -z "$REGION" ] && echo "ERROR: No region" && exit 1; export AWS_DEFAULT_REGION="$REGION"; echo "Region: $REGION"
 echo "Step 1: Listing all buckets"; aws s3api list-buckets --query 'Buckets[].{Name:Name,Created:CreationDate}' --output table
 echo "Step 2: Bucket count"; echo "  Total: $(aws s3api list-buckets --query 'Buckets | length(@)' --output text) buckets"
 echo "Step 3: Checking public access block"; B=$(aws s3api list-buckets --query 'Buckets[0].Name' --output text); [ -n "$B" ] && [ "$B" != "None" ] && aws s3api get-public-access-block --bucket "$B" --query 'PublicAccessBlockConfiguration' --output table 2>/dev/null || echo "  No public access block"
diff --git a/tuts/214-s3-bucket-tagging/REVISION-HISTORY.md b/tuts/214-s3-bucket-tagging/REVISION-HISTORY.md
new file mode 100644
index 00000000..8b8865e4
--- /dev/null
+++ b/tuts/214-s3-bucket-tagging/REVISION-HISTORY.md
@@ -0,0 +1,8 @@
+# Revision History: 214-s3-bucket-tagging
+
+## Shell (CLI script)
+
+### 2026-04-14 v1 published
+- Type: functional
+- Initial version
+
diff --git a/tuts/214-s3-bucket-tagging/s3-bucket-tagging.sh b/tuts/214-s3-bucket-tagging/s3-bucket-tagging.sh
index 45b92f83..bb45ae89 100644
--- a/tuts/214-s3-bucket-tagging/s3-bucket-tagging.sh
+++ b/tuts/214-s3-bucket-tagging/s3-bucket-tagging.sh
@@ -1,7 +1,7 @@
 #!/bin/bash
 WORK_DIR=$(mktemp -d); exec > >(tee -a "$WORK_DIR/tut.log") 2>&1
-REGION=${AWS_DEFAULT_REGION:-$(aws configure get region 2>/dev/null)}; [ -z "$REGION" ] && echo "ERROR: No region" && exit 1; export AWS_DEFAULT_REGION="$REGION"; echo "Region: $REGION"
-RANDOM_ID=$(openssl rand -hex 4); ACCOUNT=$(aws sts get-caller-identity --query Account --output text); B="tag-tut-${RANDOM_ID}-${ACCOUNT}"
+REGION=${AWS_DEFAULT_REGION:-${AWS_REGION:-$(aws configure get region 2>/dev/null))}; [ -z "$REGION" ] && echo "ERROR: No region" && exit 1; export AWS_DEFAULT_REGION="$REGION"; echo "Region: $REGION"
+RANDOM_ID=$(cat /dev/urandom | tr -dc 'a-z0-9' | fold -w 8 | head -n 1); ACCOUNT=$(aws sts get-caller-identity --query Account --output text); B="tag-tut-${RANDOM_ID}-${ACCOUNT}"
 cleanup() { aws s3 rb "s3://$B" 2>/dev/null; rm -rf "$WORK_DIR"; echo "Done."; }
 echo "Step 1: Creating bucket"; aws s3api create-bucket --bucket "$B" > /dev/null
 echo "Step 2: Adding tags"; aws s3api put-bucket-tagging --bucket "$B" --tagging 'TagSet=[{Key=Environment,Value=tutorial},{Key=Project,Value=tagging-demo},{Key=Owner,Value=tutorial-user}]'

From 52a7fd73d88eb01759c1800f9e97f8425a31b0bc Mon Sep 17 00:00:00 2001
From: Michael Wunderlich <mwunderl@amazon.com>
Date: Tue, 21 Apr 2026 05:38:02 +0000
Subject: [PATCH 3/3] Add README.md and tutorial walkthrough for script-only
 tutorials

---
 tuts/198-s3-cors/README.md                    | 38 ++++++++++++++++++
 tuts/198-s3-cors/s3-cors.md                   | 23 +++++++++++
 tuts/202-s3-storage-classes/README.md         | 27 +++++++++++++
 .../s3-storage-classes.md                     | 15 +++++++
 tuts/206-s3-metrics/README.md                 | 28 +++++++++++++
 tuts/206-s3-metrics/s3-metrics.md             | 15 +++++++
 tuts/209-s3-list-buckets/README.md            | 28 +++++++++++++
 tuts/209-s3-list-buckets/s3-list-buckets.md   | 19 +++++++++
 tuts/214-s3-bucket-tagging/README.md          | 39 +++++++++++++++++++
 .../s3-bucket-tagging.md                      | 27 +++++++++++++
 10 files changed, 259 insertions(+)
 create mode 100644 tuts/198-s3-cors/README.md
 create mode 100644 tuts/198-s3-cors/s3-cors.md
 create mode 100644 tuts/202-s3-storage-classes/README.md
 create mode 100644 tuts/202-s3-storage-classes/s3-storage-classes.md
 create mode 100644 tuts/206-s3-metrics/README.md
 create mode 100644 tuts/206-s3-metrics/s3-metrics.md
 create mode 100644 tuts/209-s3-list-buckets/README.md
 create mode 100644 tuts/209-s3-list-buckets/s3-list-buckets.md
 create mode 100644 tuts/214-s3-bucket-tagging/README.md
 create mode 100644 tuts/214-s3-bucket-tagging/s3-bucket-tagging.md

diff --git a/tuts/198-s3-cors/README.md b/tuts/198-s3-cors/README.md
new file mode 100644
index 00000000..2fb21502
--- /dev/null
+++ b/tuts/198-s3-cors/README.md
@@ -0,0 +1,38 @@
+# S3 Cors
+
+An AWS CLI tutorial that demonstrates S3 operations.
+
+## Running
+
+```bash
+bash s3-cors.sh
+```
+
+To auto-run with cleanup:
+
+```bash
+echo 'y' | bash s3-cors.sh
+```
+
+## What it does
+
+1. Creating bucket"; aws s3api create-bucket --bucket "$B
+2. Setting CORS"; aws s3api put-bucket-cors --bucket "$B" --cors-configuration '{"CORSRules":[{"AllowedOrigins":["https://example.com"],"AllowedMethods":["GET","PUT"],"AllowedHeaders":["*"],"MaxAgeSeconds
+3. Getting CORS"; aws s3api get-bucket-cors --bucket "$B
+
+## Resources created
+
+- Bucket
+- Bucket Cors
+
+The script prompts you to clean up resources when it finishes.
+
+## Cost
+
+Free tier eligible for most operations. Clean up resources after use to avoid charges.
+
+## Related docs
+
+- [AWS CLI s3 reference](https://docs.aws.amazon.com/cli/latest/reference/s3/index.html)
+- [AWS CLI s3api reference](https://docs.aws.amazon.com/cli/latest/reference/s3api/index.html)
+
diff --git a/tuts/198-s3-cors/s3-cors.md b/tuts/198-s3-cors/s3-cors.md
new file mode 100644
index 00000000..2c7831c7
--- /dev/null
+++ b/tuts/198-s3-cors/s3-cors.md
@@ -0,0 +1,23 @@
+# S3 Cors
+
+## Prerequisites
+
+1. AWS CLI installed and configured (`aws configure`)
+2. Appropriate IAM permissions for the AWS services used
+
+## Step 1: Creating bucket"; aws s3api create-bucket --bucket "$B
+
+The script handles this step automatically. See `s3-cors.sh` for the exact CLI commands.
+
+## Step 2: Setting CORS"; aws s3api put-bucket-cors --bucket "$B" --cors-configuration '{"CORSRules":[{"AllowedOrigins":["https://example.com"],"AllowedMethods":["GET","PUT"],"AllowedHeaders":["*"],"MaxAgeSeconds
+
+The script handles this step automatically. See `s3-cors.sh` for the exact CLI commands.
+
+## Step 3: Getting CORS"; aws s3api get-bucket-cors --bucket "$B
+
+The script handles this step automatically. See `s3-cors.sh` for the exact CLI commands.
+
+## Cleanup
+
+The script prompts you to clean up all created resources. If you need to clean up manually, check the script log for the resource names that were created.
+
diff --git a/tuts/202-s3-storage-classes/README.md b/tuts/202-s3-storage-classes/README.md
new file mode 100644
index 00000000..bdf1ca92
--- /dev/null
+++ b/tuts/202-s3-storage-classes/README.md
@@ -0,0 +1,27 @@
+# S3 Storage Classes
+
+A read-only script that queries S3Api resources and displays information.
+
+## Running
+
+```bash
+bash s3-storage-classes.sh
+```
+
+## What it does
+
+1. Listing objects with storage classes
+2. Storage class reference
+
+## Resources created
+
+None — this script is read-only.
+
+## Cost
+
+No cost. This script only reads existing resources.
+
+## Related docs
+
+- [AWS CLI s3api reference](https://docs.aws.amazon.com/cli/latest/reference/s3api/index.html)
+
diff --git a/tuts/202-s3-storage-classes/s3-storage-classes.md b/tuts/202-s3-storage-classes/s3-storage-classes.md
new file mode 100644
index 00000000..f6635ab1
--- /dev/null
+++ b/tuts/202-s3-storage-classes/s3-storage-classes.md
@@ -0,0 +1,15 @@
+# S3 Storage Classes
+
+## Prerequisites
+
+1. AWS CLI installed and configured (`aws configure`)
+2. Appropriate IAM permissions for the AWS services used
+
+## Step 1: Listing objects with storage classes
+
+The script handles this step automatically. See `s3-storage-classes.sh` for the exact CLI commands.
+
+## Step 2: Storage class reference
+
+The script handles this step automatically. See `s3-storage-classes.sh` for the exact CLI commands.
+
diff --git a/tuts/206-s3-metrics/README.md b/tuts/206-s3-metrics/README.md
new file mode 100644
index 00000000..081bd90b
--- /dev/null
+++ b/tuts/206-s3-metrics/README.md
@@ -0,0 +1,28 @@
+# S3 Metrics
+
+A read-only script that queries Cloudwatch resources and displays information.
+
+## Running
+
+```bash
+bash s3-metrics.sh
+```
+
+## What it does
+
+1. Listing buckets with sizes
+2. Getting bucket metrics (request count)
+
+## Resources created
+
+None — this script is read-only.
+
+## Cost
+
+No cost. This script only reads existing resources.
+
+## Related docs
+
+- [AWS CLI cloudwatch reference](https://docs.aws.amazon.com/cli/latest/reference/cloudwatch/index.html)
+- [AWS CLI s3api reference](https://docs.aws.amazon.com/cli/latest/reference/s3api/index.html)
+
diff --git a/tuts/206-s3-metrics/s3-metrics.md b/tuts/206-s3-metrics/s3-metrics.md
new file mode 100644
index 00000000..cc702628
--- /dev/null
+++ b/tuts/206-s3-metrics/s3-metrics.md
@@ -0,0 +1,15 @@
+# S3 Metrics
+
+## Prerequisites
+
+1. AWS CLI installed and configured (`aws configure`)
+2. Appropriate IAM permissions for the AWS services used
+
+## Step 1: Listing buckets with sizes
+
+The script handles this step automatically. See `s3-metrics.sh` for the exact CLI commands.
+
+## Step 2: Getting bucket metrics (request count)
+
+The script handles this step automatically. See `s3-metrics.sh` for the exact CLI commands.
+
diff --git a/tuts/209-s3-list-buckets/README.md b/tuts/209-s3-list-buckets/README.md
new file mode 100644
index 00000000..26bacb46
--- /dev/null
+++ b/tuts/209-s3-list-buckets/README.md
@@ -0,0 +1,28 @@
+# S3 List Buckets
+
+A read-only script that queries S3Api resources and displays information.
+
+## Running
+
+```bash
+bash s3-list-buckets.sh
+```
+
+## What it does
+
+1. Listing all buckets
+2. Bucket count"; echo "  Total: $(aws s3api list-buckets --query 'Buckets | length(@)' --output text) buckets
+3. Checking public access block"; B=$(aws s3api list-buckets --query 'Buckets[0].Name' --output text); [ -n "$B" ] && [ "$B" != "None" ] && aws s3api get-public-access-block --bucket "$B" --query 'PublicAccessBlockConfiguration' --output table 2>/dev/null || echo "  No public access block
+
+## Resources created
+
+None — this script is read-only.
+
+## Cost
+
+No cost. This script only reads existing resources.
+
+## Related docs
+
+- [AWS CLI s3api reference](https://docs.aws.amazon.com/cli/latest/reference/s3api/index.html)
+
diff --git a/tuts/209-s3-list-buckets/s3-list-buckets.md b/tuts/209-s3-list-buckets/s3-list-buckets.md
new file mode 100644
index 00000000..9b33dba1
--- /dev/null
+++ b/tuts/209-s3-list-buckets/s3-list-buckets.md
@@ -0,0 +1,19 @@
+# S3 List Buckets
+
+## Prerequisites
+
+1. AWS CLI installed and configured (`aws configure`)
+2. Appropriate IAM permissions for the AWS services used
+
+## Step 1: Listing all buckets
+
+The script handles this step automatically. See `s3-list-buckets.sh` for the exact CLI commands.
+
+## Step 2: Bucket count"; echo "  Total: $(aws s3api list-buckets --query 'Buckets | length(@)' --output text) buckets
+
+The script handles this step automatically. See `s3-list-buckets.sh` for the exact CLI commands.
+
+## Step 3: Checking public access block"; B=$(aws s3api list-buckets --query 'Buckets[0].Name' --output text); [ -n "$B" ] && [ "$B" != "None" ] && aws s3api get-public-access-block --bucket "$B" --query 'PublicAccessBlockConfiguration' --output table 2>/dev/null || echo "  No public access block
+
+The script handles this step automatically. See `s3-list-buckets.sh` for the exact CLI commands.
+
diff --git a/tuts/214-s3-bucket-tagging/README.md b/tuts/214-s3-bucket-tagging/README.md
new file mode 100644
index 00000000..92192b2c
--- /dev/null
+++ b/tuts/214-s3-bucket-tagging/README.md
@@ -0,0 +1,39 @@
+# S3 Bucket Tagging
+
+An AWS CLI tutorial that demonstrates S3 operations.
+
+## Running
+
+```bash
+bash s3-bucket-tagging.sh
+```
+
+To auto-run with cleanup:
+
+```bash
+echo 'y' | bash s3-bucket-tagging.sh
+```
+
+## What it does
+
+1. Creating bucket"; aws s3api create-bucket --bucket "$B
+2. Adding tags"; aws s3api put-bucket-tagging --bucket "$B
+3. Getting tags"; aws s3api get-bucket-tagging --bucket "$B
+4. Deleting tags"; aws s3api delete-bucket-tagging --bucket "$B"; echo "  Tags deleted
+
+## Resources created
+
+- Bucket
+- Bucket Tagging
+
+The script prompts you to clean up resources when it finishes.
+
+## Cost
+
+Free tier eligible for most operations. Clean up resources after use to avoid charges.
+
+## Related docs
+
+- [AWS CLI s3 reference](https://docs.aws.amazon.com/cli/latest/reference/s3/index.html)
+- [AWS CLI s3api reference](https://docs.aws.amazon.com/cli/latest/reference/s3api/index.html)
+
diff --git a/tuts/214-s3-bucket-tagging/s3-bucket-tagging.md b/tuts/214-s3-bucket-tagging/s3-bucket-tagging.md
new file mode 100644
index 00000000..282f9b05
--- /dev/null
+++ b/tuts/214-s3-bucket-tagging/s3-bucket-tagging.md
@@ -0,0 +1,27 @@
+# S3 Bucket Tagging
+
+## Prerequisites
+
+1. AWS CLI installed and configured (`aws configure`)
+2. Appropriate IAM permissions for the AWS services used
+
+## Step 1: Creating bucket"; aws s3api create-bucket --bucket "$B
+
+The script handles this step automatically. See `s3-bucket-tagging.sh` for the exact CLI commands.
+
+## Step 2: Adding tags"; aws s3api put-bucket-tagging --bucket "$B
+
+The script handles this step automatically. See `s3-bucket-tagging.sh` for the exact CLI commands.
+
+## Step 3: Getting tags"; aws s3api get-bucket-tagging --bucket "$B
+
+The script handles this step automatically. See `s3-bucket-tagging.sh` for the exact CLI commands.
+
+## Step 4: Deleting tags"; aws s3api delete-bucket-tagging --bucket "$B"; echo "  Tags deleted
+
+The script handles this step automatically. See `s3-bucket-tagging.sh` for the exact CLI commands.
+
+## Cleanup
+
+The script prompts you to clean up all created resources. If you need to clean up manually, check the script log for the resource names that were created.
+