aws s3 rm --recursive in Claude Code — agent safety guide
Claude Code agents frequently attempt aws s3 rm --recursive during autonomous sessions.
aws s3 rm --recursive
Blast radius
Every object under the targeted prefix. On non-versioned buckets, the objects are gone. On versioned buckets, the current versions get delete markers but the previous versions remain billable until lifecycle rules collect them. Cross-region replicas are NOT auto-deleted; deletion replication must be explicitly enabled.
Why agents reach for it
Agents reach for it during 'clean up old uploads', 'reset dev bucket', 'delete failed multipart uploads', and bucket-migration tasks. The risk peaks when bucket names follow a `prod-` / `dev-` pattern and a typo flips them.
Recovery options
Versioned buckets: `aws s3api list-object-versions` lists prior versions, remove the delete markers to restore. Non-versioned buckets: recovery is only via Glacier vault lock copies (if configured), AWS Backup vaults (if enabled for S3), or Macie's discovery snapshots — all opt-in. Without any of these, recovery is impossible.
Real-world incident
An agent ran `aws s3 rm s3://hp-customer-uploads/ --recursive` thinking it was the `hp-test-uploads/` bucket. The customer bucket held 4 years of user file uploads with versioning disabled. Lifecycle hadn't been configured to transition to Glacier. Total loss: 1.4 TB of customer data, regulatory disclosure required.
Block it with DestructGuard's default tier
DestructGuard's default rules tier includes aws s3 rm --recursive by default — the call is intercepted at the shell or process boundary before execution. Approvals are logged to JSONL with timestamp, caller, command, and decision. Pair with git pre-commit and pre-push hooks from the Pro Pack so destructive patterns are blocked at multiple points in the agent pipeline.
From guidance to an enforceable agent loop
Preflight this command before an agent executes it
Start with the one-cent Action Safety Quick Gate. Low risk can proceed, medium risk routes to full DestructGuard evidence, and high or critical risk routes to the complete workflow for ReviewQueue triage, a signed receipt, and a privacy-preserving status record. Triage never implies human approval.