AWS S3 Bucket Policy Updates
This query outputs all S3 buckets where the policy has been modified.
CQL · Falcon Next-Gen SIEMCopy query
#Vendor="aws" #event.dataset="cloudtrail.s3" #repo!="xdr*"
| #event.kind="event" #event.outcome="success"
| event.action="PutBucketPolicy"
| cloud.Storage.bucket_name =~ in(values=[?BucketName])
| cloud.account.id =~ in(values=[?AwsAccount])
| UserARN := getField("Vendor.userIdentity.arn")
| BucketName := getField("cloud.Storage.bucket_name")
| select(["@timestamp","BucketName", "UserARN"])AWS PutBucketPolicy: https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketPolicy.html
aws_s3_bucket_policy_updates.yml
ByteRay GmbH
Monitoring
Cloud
2025-08-06
2025-11-01
