AWS cli: GuardDuty describe-publishing-destination documents ExpectedBucketOwner
Summary
Adds the ExpectedBucketOwner field to the DestinationProperties response structure documentation, describing bucket-owner verification behavior and constraints (12 characters).
Security assessment
Documents the response field that surfaces the bucket-owner verification control, which mitigates export of findings to an attacker-controlled bucket after a bucket-name takeover.
Evidence
+>> When you provide this value, GuardDuty verifies that the specified account owns the bucket before it exports findings. If the account ID doesn’t match the actual owner of the bucket, GuardDuty doesn’t export findings to that bucket. This helps prevent GuardDuty from exporting your findings to a bucket that a different Amazon Web Services account owns (for example, if the original bucket was deleted and its name was later claimed by another account). If you don’t specify this value, GuardDuty doesn’t perform this verification. GuardDuty strongly recommends that you provide the expected bucket owner when possible.
Diff
diff --git a/cli/latest/reference/guardduty/describe-publishing-destination.md b/cli/latest/reference/guardduty/describe-publishing-destination.md index 728c8cd..4a43b9a 100644 --- a//cli/latest/reference/guardduty/describe-publishing-destination.md +++ b//cli/latest/reference/guardduty/describe-publishing-destination.md @@ -15 +15 @@ - * [AWS CLI 2.38.1 Command Reference](../../index.html) » + * [AWS CLI 2.38.2 Command Reference](../../index.html) » @@ -281,0 +282,17 @@ DestinationProperties -> (structure) +> +> ExpectedBucketOwner -> (string) +> +>> The 12-digit Amazon Web Services account ID of the account that owns the Amazon S3 bucket specified in the `DestinationArn` parameter. +>> +>> When you provide this value, GuardDuty verifies that the specified account owns the bucket before it exports findings. If the account ID doesn’t match the actual owner of the bucket, GuardDuty doesn’t export findings to that bucket. This helps prevent GuardDuty from exporting your findings to a bucket that a different Amazon Web Services account owns (for example, if the original bucket was deleted and its name was later claimed by another account). If you don’t specify this value, GuardDuty doesn’t perform this verification. GuardDuty strongly recommends that you provide the expected bucket owner when possible. +>> +>> When you update a publishing destination, omitting this field leaves the currently stored value unchanged. This field appears in the response only if it was provided when the publishing destination was created or updated. +>> +>> For more information, see [Verifying the Amazon S3 bucket owner](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_exportfindings.html#guardduty-exportfindings-expected-bucket-owner) in the _Amazon GuardDuty User Guide_ . +>> +>> Constraints: +>> +>> * min: `12` +>> * max: `12` +>> + @@ -323 +340 @@ Tags -> (map) - * [AWS CLI 2.38.1 Command Reference](../../index.html) » + * [AWS CLI 2.38.2 Command Reference](../../index.html) »