AWS cli: GuardDuty create-publishing-destination adds ExpectedBucketOwner
Summary
Adds the new ExpectedBucketOwner parameter (12-digit account ID) to the create-publishing-destination command, including shorthand/JSON syntax and documentation explaining that GuardDuty verifies the S3 bucket owner before exporting findings.
Security assessment
The added parameter and text explicitly address a concrete weakness: findings could be exported to a bucket whose name was re-registered by a different AWS account (bucket-name takeover / confused-deputy style data exposure). GuardDuty now verifies bucket ownership, preventing cross-account leakage of security findings.
Evidence
+>> When you provide this value, GuardDuty verifies that the specified account owns the bucket before it exports findings. If the account ID doesn’t match the actual owner of the bucket, GuardDuty doesn’t export findings to that bucket. This helps prevent GuardDuty from exporting your findings to a bucket that a different Amazon Web Services account owns (for example, if the original bucket was deleted and its name was later claimed by another account). If you don’t specify this value, GuardDuty doesn’t perform this verification. GuardDuty strongly recommends that you provide the expected bucket owner when possible.
Diff
diff --git a/cli/latest/reference/guardduty/create-publishing-destination.md b/cli/latest/reference/guardduty/create-publishing-destination.md index 03f2d29..4731d10 100644 --- a//cli/latest/reference/guardduty/create-publishing-destination.md +++ b//cli/latest/reference/guardduty/create-publishing-destination.md @@ -15 +15 @@ - * [AWS CLI 2.38.1 Command Reference](../../index.html) » + * [AWS CLI 2.38.2 Command Reference](../../index.html) » @@ -140,0 +141,17 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/guardd +> +> ExpectedBucketOwner -> (string) +> +>> The 12-digit Amazon Web Services account ID of the account that owns the Amazon S3 bucket specified in the `DestinationArn` parameter. +>> +>> When you provide this value, GuardDuty verifies that the specified account owns the bucket before it exports findings. If the account ID doesn’t match the actual owner of the bucket, GuardDuty doesn’t export findings to that bucket. This helps prevent GuardDuty from exporting your findings to a bucket that a different Amazon Web Services account owns (for example, if the original bucket was deleted and its name was later claimed by another account). If you don’t specify this value, GuardDuty doesn’t perform this verification. GuardDuty strongly recommends that you provide the expected bucket owner when possible. +>> +>> When you update a publishing destination, omitting this field leaves the currently stored value unchanged. This field appears in the response only if it was provided when the publishing destination was created or updated. +>> +>> For more information, see [Verifying the Amazon S3 bucket owner](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_exportfindings.html#guardduty-exportfindings-expected-bucket-owner) in the _Amazon GuardDuty User Guide_ . +>> +>> Constraints: +>> +>> * min: `12` +>> * max: `12` +>> + @@ -145 +162 @@ Shorthand Syntax: - DestinationArn=string,KmsKeyArn=string + DestinationArn=string,KmsKeyArn=string,ExpectedBucketOwner=string @@ -153 +170,2 @@ JSON Syntax: - "KmsKeyArn": "string" + "KmsKeyArn": "string", + "ExpectedBucketOwner": "string" @@ -367 +385 @@ DestinationId -> (string) - * [AWS CLI 2.38.1 Command Reference](../../index.html) » + * [AWS CLI 2.38.2 Command Reference](../../index.html) »