DET-05: Guardrail change on the state bucket¶
A bucket policy, ACL or public-access-block change on the bootstrap state.
| Property | Value |
|---|---|
| Severity | high |
| Platform | AWS Nitro Enclaves |
| Group | cloud |
| Log source | CloudTrail · S3 |
| Related check | BOOTSTRAP-02: S3 bucket write scope |
Fires when¶
eventName IN [PutBucketPolicy, PutBucketAcl, PutBucketVersioning, DeleteBucketEncryption, PutBucketPublicAccessBlock] AND bucket == state_bucket
How it runs¶
untrust detect --platform nitro reads CloudTrail in the region you pass with --region, over the last --since minutes (default 60).
A match is a detection event with this rule's ID. Upload it to the console to alert on it; see Runtime detections.