source-s3-select

Read-only source adapter: Amazon S3 Select query in, raw JSONL rows out. This skill does not normalize vendor data, detect threats, or write back to S3. It exists so operators and agents can fetch already-landed lake data and pipe it into the existing ingest-*, detect-*, discover-*, or view/* skills.

Use when

• Security data already lives in S3 as JSON lines or JSON documents
• You want to fetch rows directly into a skill pipeline without downloading the full object
• You need a read-only source step before ingest-* or detect-*

Do NOT use

• For PUT, COPY, DELETE, lifecycle, ACL, bucket-policy, or object-mutation operations
• As a detection or remediation skill
• When the source data is not in S3
• When the object format is not supported by S3 Select for JSON input