aws_s3_bucket_details.json

{
  "creation_date": "2018-06-26",
  "data_metadata": {
    "data_source": [
      "AWS Configuration Logs"
    ],
    "data_sourcetypes": [
      "aws:config"
    ],
    "providing_technologies": [
      "AWS"
    ]
  },
  "description": "This search queries AWS configuration logs and returns the information about a specific S3 bucket. The information returned includes the time the S3 bucket was created, the resource ID, the region it belongs to, the value of action performed, AWS account ID, and configuration values of the access-control lists associated with the bucket.",
  "entities": [
    "bucketName"
  ],
  "how_to_implement": "To implement this search, you must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later) and configure your AWS inputs.",
  "id": "f3fb2q1c-5f33-4b01-b541-c2ah9534c242",
  "investigate": {
    "splunk": {
      "fields_required": [
        "bucketName"
      ],
      "schedule": {
        "cron_schedule": "",
        "earliest_time": "86400",
        "latest_time": "0"
      },
      "search": "| search sourcetype=aws:config resourceId={bucketName} | table resourceCreationTime resourceId awsRegion action aws_account_id supplementaryConfiguration.AccessControlList"
    }
  },
  "maintainers": [
    {
      "company": "Splunk",
      "email": "bpatel@splunk.com",
      "name": "Bhavin Patel"
    }
  ],
  "modification_date": "2018-06-26",
  "name": "AWS S3 Bucket details via bucketName",
  "original_authors": [
    {
      "company": "Splunk",
      "email": "bpatel@splunk.com",
      "name": "Bhavin Patel"
    }
  ],
  "spec_version": 2,
  "type": "splunk",
  "version": "1.0"
}