AWS cli: GuardDuty update-publishing-destination adds ExpectedBucketOwner

Service: cli · 2026-10-20 · Security-related high

File: cli/latest/reference/guardduty/update-publishing-destination.md · Type: authz

Summary

Adds the ExpectedBucketOwner parameter to the update-publishing-destination command (shorthand and JSON syntax) with documentation on bucket-owner verification and the note that omitting it leaves the stored value unchanged.

Security assessment

The new parameter lets callers enforce that GuardDuty only exports findings to a bucket owned by the expected account, preventing cross-account data exposure when a destination bucket name is re-claimed by another account.

Evidence

+    DestinationArn=string,KmsKeyArn=string,ExpectedBucketOwner=string

Diff

diff --git a/cli/latest/reference/guardduty/update-publishing-destination.md b/cli/latest/reference/guardduty/update-publishing-destination.md
index cbc2418..e74134f 100644
--- a//cli/latest/reference/guardduty/update-publishing-destination.md
+++ b//cli/latest/reference/guardduty/update-publishing-destination.md
@@ -15 +15 @@
-  * [AWS CLI 2.38.1 Command Reference](../../index.html) »
+  * [AWS CLI 2.38.2 Command Reference](../../index.html) »
@@ -124,0 +125,17 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/guardd
+> 
+> ExpectedBucketOwner -> (string)
+>
+>> The 12-digit Amazon Web Services account ID of the account that owns the Amazon S3 bucket specified in the `DestinationArn` parameter.
+>> 
+>> When you provide this value, GuardDuty verifies that the specified account owns the bucket before it exports findings. If the account ID doesn’t match the actual owner of the bucket, GuardDuty doesn’t export findings to that bucket. This helps prevent GuardDuty from exporting your findings to a bucket that a different Amazon Web Services account owns (for example, if the original bucket was deleted and its name was later claimed by another account). If you don’t specify this value, GuardDuty doesn’t perform this verification. GuardDuty strongly recommends that you provide the expected bucket owner when possible.
+>> 
+>> When you update a publishing destination, omitting this field leaves the currently stored value unchanged. This field appears in the response only if it was provided when the publishing destination was created or updated.
+>> 
+>> For more information, see [Verifying the Amazon S3 bucket owner](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_exportfindings.html#guardduty-exportfindings-expected-bucket-owner) in the _Amazon GuardDuty User Guide_ .
+>> 
+>> Constraints:
+>> 
+>>   * min: `12`
+>>   * max: `12`
+>> 
+
@@ -129 +146 @@ Shorthand Syntax:
-    DestinationArn=string,KmsKeyArn=string
+    DestinationArn=string,KmsKeyArn=string,ExpectedBucketOwner=string
@@ -137 +154,2 @@ JSON Syntax:
-      "KmsKeyArn": "string"
+      "KmsKeyArn": "string",
+      "ExpectedBucketOwner": "string"
@@ -266 +284 @@ None
-  * [AWS CLI 2.38.1 Command Reference](../../index.html) »
+  * [AWS CLI 2.38.2 Command Reference](../../index.html) »