AWS S3 Bucket Expiration Lifecycle Configuration Added

Triage and analysis

Investigating AWS S3 Bucket Expiration Lifecycle Configuration Added

This rule detects when a lifecycle expiration policy is added to an S3 bucket via the PutBucketLifecycle or PutBucketLifecycleConfiguration API. Note: PutBucketLifecycleConfiguration is the newer supported API call, however both of these API calls show up as PutBucketLifecycle in Cloudtrail ref. Lifecycle expiration automatically deletes objects after a defined period (Expiration:Days), which can be leveraged by adversaries to erase logs, exfiltration evidence, or security artifacts before detection and response teams can review them.

Because deletion is automated and often silent, detecting the initial configuration event is critical.

Possible investigation steps

Identify the actor and execution context

Examine the lifecycle configuration details - Extract details from aws.cloudtrail.request_parameters: - Expiration: Number of days until deletion (e.g., Days=1 indicates rapid expiry). - Prefix: If limited to certain object paths (e.g., /logs/, /tmp/). - Status: Enabled vs. Disabled. - ID or rule name: May reveal purpose (“cleanup-test”, “delete-logs”). - Determine the affected bucket from aws.cloudtrail.resources.arn or aws.cloudtrail.resources.type. Cross-check the bucket’s purpose (e.g., log storage, data lake, analytics export, threat forensics). - High-risk if the bucket contains audit, CloudTrail, or application logs.

Correlate with related AWS activity Use AWS CloudTrail search or your SIEM to pivot for: - Prior suspicious activity: - DeleteObject, PutBucketPolicy, PutBucketAcl, or PutBucketLogging changes to disable visibility. - IAM changes such as AttachUserPolicy or CreateAccessKey that may have enabled this modification. - Subsequent changes: - PutBucketLifecycle events in other buckets (repeated pattern). - Rapid DeleteObject events or object expiration confirmations. - Cross-account activity: - Lifecycle rules followed by replication or cross-account copy events may indicate lateral exfiltration setup.

Assess intent and risk - Verify if the actor has a valid business case for altering object retention. - If the bucket is used for security, compliance, or audit data, treat this as potential defense evasion. - Evaluate whether the lifecycle rule removes data faster than your retention policy permits.

False positive analysis

Response and remediation

Containment and validation 1. Revert or disable the lifecycle configuration if it is unauthorized: - Use the AWS Console or CLI (delete-bucket-lifecycle or put-bucket-lifecycle-configuration --lifecycle-configuration Disabled). 2. Preserve evidence: - Copy existing objects (especially logs or forensic data) before they expire. - Enable object versioning or replication to protect against loss.

Investigation 3. Review CloudTrail and S3 Access Logs for the same bucket: - Identify who and what performed previous deletions. - Determine whether any objects of investigative value have already been removed. 4. Search for other S3 buckets where similar lifecycle configurations were added in a short timeframe.

Recovery and hardening 5. Implement guardrails: - Use AWS Config rules like s3-bucket-lifecycle-configuration-check to monitor lifecycle changes. - Restrict s3:PutLifecycleConfiguration to specific administrative roles. - Enable S3 Object Lock on log or evidence buckets to enforce immutability. 6. Enable Security Hub and GuardDuty findings for additional anomaly detection on S3 data management activity.

Additional information

info where event.dataset == "aws.cloudtrail"
   and event.action == "PutBucketLifecycle"
   and event.outcome == "success"
   and stringContains(aws.cloudtrail.request_parameters, "Expiration=")

Framework: MITRE ATT&CK^TM