aws_cloudtrail_putbucketlifecycle.yml

name: AWS CloudTrail PutBucketLifecycle
id: 1c73e954-87b6-4bd7-ac6a-5db7c4082b22
version: 2
date: '2025-01-23'
author: Patrick Bareiss, Splunk
description: Logs an event when a lifecycle configuration is added to an S3 bucket
  in AWS CloudTrail.
mitre_components:
- Cloud Storage Modification
- Cloud Storage Metadata
source: aws_cloudtrail
sourcetype: aws:cloudtrail
separator: eventName
separator_value: PutBucketLifecycle
supported_TA:
- name: Splunk Add-on for AWS
  url: https://splunkbase.splunk.com/app/1876
  version: 7.9.1
fields:
- _time
- additionalEventData.AuthenticationMethod
- additionalEventData.CipherSuite
- additionalEventData.SignatureVersion
- additionalEventData.bytesTransferredIn
- additionalEventData.bytesTransferredOut
- additionalEventData.x-amz-id-2
- app
- awsRegion
- aws_account_id
- command
- date_hour
- date_mday
- date_minute
- date_month
- date_second
- date_wday
- date_year
- date_zone
- dest
- dvc
- errorCode
- eventCategory
- eventID
- eventName
- eventSource
- eventTime
- eventType
- eventVersion
- host
- index
- linecount
- managementEvent
- msg
- object
- object_category
- object_id
- product
- punct
- readOnly
- recipientAccountId
- region
- requestID
- requestParameters.Host
- requestParameters.LifecycleConfiguration.Rule.Expiration.Days
- requestParameters.LifecycleConfiguration.Rule.Filter.Prefix
- requestParameters.LifecycleConfiguration.Rule.ID
- requestParameters.LifecycleConfiguration.Rule.Status
- requestParameters.LifecycleConfiguration.xmlns
- requestParameters.bucketName
- requestParameters.lifecycle
- resources{}.ARN
- resources{}.accountId
- resources{}.type
- responseElements
- signature
- source
- sourceIPAddress
- sourcetype
- splunk_server
- src
- src_ip
- start_time
- timeendpos
- timestartpos
- tlsDetails.cipherSuite
- tlsDetails.clientProvidedHostHeader
- tlsDetails.tlsVersion
- user
- userAgent
- userIdentity.accessKeyId
- userIdentity.accountId
- userIdentity.arn
- userIdentity.principalId
- userIdentity.type
- userIdentity.userName
- userName
- user_access_key
- user_agent
- user_arn
- user_group_id
- user_id
- user_name
- user_type
- vendor
- vendor_account
- vendor_product
- vendor_region
example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId":
  "AIDAYTOGP2RLEHRX5YWNV", "arn": "arn:aws:iam::111111111111:user/bhavin_cli", "accountId":
  "111111111111", "accessKeyId": "AKIAYTOGP2RLKQ3U2PDY", "userName": "bhavin_cli"},
  "eventTime": "2022-07-13T21:58:27Z", "eventSource": "s3.amazonaws.com", "eventName":
  "PutBucketLifecycle", "awsRegion": "us-west-2", "sourceIPAddress": "192.184.242.57",
  "userAgent": "[stratus-red-team_d73089cf-1905-430c-b6d3-4dc4d669190f]", "requestParameters":
  {"lifecycle": "", "bucketName": "my-cloudtrail-bucket-alfsujjpnbpguqrh", "LifecycleConfiguration":
  {"xmlns": "http://s3.amazonaws.com/doc/2006-03-01/", "Rule": {"Status": "Enabled",
  "Filter": {"Prefix": "*"}, "Expiration": {"Days": 1}, "ID": "nuke-cloudtrail-logs-after-1-day"}},
  "Host": "my-cloudtrail-bucket-alfsujjpnbpguqrh.s3.us-west-2.amazonaws.com"}, "responseElements":
  null, "additionalEventData": {"SignatureVersion": "SigV4", "CipherSuite": "ECDHE-RSA-AES128-GCM-SHA256",
  "bytesTransferredIn": 249, "AuthenticationMethod": "AuthHeader", "x-amz-id-2": "TVXZE5kOVTMLqYlmKK+j/5g6flwkiFXFfw8PyNivFO4/9YXnDsyzFlGEzAy2rukTTiukLdEwtuM=",
  "bytesTransferredOut": 0}, "requestID": "1P8X27T2BCMY93Y9", "eventID": "25d92cd1-f366-4b11-b408-967a17ce70f3",
  "readOnly": false, "resources": [{"accountId": "111111111111", "type": "AWS::S3::Bucket",
  "ARN": "arn:aws:s3:::my-cloudtrail-bucket-alfsujjpnbpguqrh"}], "eventType": "AwsApiCall",
  "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory":
  "Management", "tlsDetails": {"tlsVersion": "TLSv1.2", "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256",
  "clientProvidedHostHeader": "my-cloudtrail-bucket-alfsujjpnbpguqrh.s3.us-west-2.amazonaws.com"}}'
output_fields:
- dest
- user
- user_agent
- src
- vendor_account
- vendor_region
- vendor_product