The commit hits, and the hook fires before code ever leaves your machine. You see the red flag: an AWS S3 bucket policy with read/write rights. It doesn’t slip past you. It can’t.
Pre-commit security hooks give your development pipeline teeth. They stop insecure IAM configurations before they touch your repository, your CI/CD, or production. For AWS S3, read-only roles are the gold standard for reducing attack surface. The fewer actions an identity can perform, the smaller the blast radius when something goes wrong.
A well-tuned pre-commit hook scans for IAM role definitions, bucket policies, and inline permissions. It checks each against a baseline: S3 access should default to s3:GetObject, and maybe s3:ListBucket if necessary. No PutObject, no DeleteObject. Anything else triggers a fail.
To integrate this, use Git hooks like pre-commit with a security linter. Tools can parse Terraform, CloudFormation, or raw JSON policies. The hook runs locally, before you push. If it finds elevated privileges, it stops the commit, logs the violation, and points to the exact resource. This closes the gap between writing code and catching policy drift.