LoFP LoFP / legitimate changes to share an s3 bucket with an external account may be identified as false positives.

Techniques

Sample rules

AWS S3 Bucket Policy Added to Share with External Account

Description

Detects when an Amazon S3 bucket policy is modified to share access with an external AWS account. This rule analyzes PutBucketPolicy events and compares the S3 bucket’s account ID to any account IDs referenced in the policy’s Effect=Allow statements. If the policy includes principals from accounts other than the bucket owner’s, the rule triggers an alert. This behavior may indicate an adversary backdooring a bucket for data exfiltration or cross-account persistence. For example, an attacker who compromises credentials could attach a policy allowing access from an external AWS account they control, enabling continued access even after credentials are rotated. Note: This rule will not alert if the account ID is part of the bucket’s name or appears in the resource ARN. Such cases are common in standardized naming conventions (e.g., “mybucket-123456789012”). To ensure full coverage, use complementary rules to monitor for suspicious PutBucketPolicy API requests targeting buckets with account IDs embedded in their names or resources.

Detection logic

info where event.dataset == "aws.cloudtrail"
    and event.provider == "s3.amazonaws.com"
    and event.action == "PutBucketPolicy" 
    and stringContains(aws.cloudtrail.request_parameters, "Effect=Allow")
    and (
        stringContains(aws.cloudtrail.request_parameters, "AWS=") or 
        stringContains(aws.cloudtrail.request_parameters, "aws:PrincipalAccount=") or
        stringContains(aws.cloudtrail.request_parameters, "aws:SourceAccount=")
        )
and not stringContains(aws.cloudtrail.request_parameters, "arn:aws:cloudfront::")  
and not stringContains(aws.cloudtrail.request_parameters, "arn:aws:iam::cloudfront:user")
and not stringContains(aws.cloudtrail.request_parameters, aws.cloudtrail.recipient_account_id)