- 필수 기능
- 시작하기
- Glossary
- 표준 속성
- Guides
- Agent
- 통합
- 개방형텔레메트리
- 개발자
- Administrator's Guide
- API
- Datadog Mobile App
- CoScreen
- Cloudcraft
- 앱 내
- 서비스 관리
- 인프라스트럭처
- 애플리케이션 성능
- APM
- Continuous Profiler
- 스팬 시각화
- 데이터 스트림 모니터링
- 데이터 작업 모니터링
- 디지털 경험
- 소프트웨어 제공
- 보안
- AI Observability
- 로그 관리
- 관리
Detect when an EC2 instance makes an API call to AWS to list all of the S3 Buckets.
This rule lets you monitor CloudTrail to detect a ListBuckets API call with the session name prefixed with i-
. A session name prefixed with i-
typically indicates that it is an EC2 instance using an Instance Profile to communicate with other AWS services, which is a common attacker technique to see the full list of S3 buckets in your AWS account.
Determine if the EC2 instance should be making this API call.
ListBuckets
API call, consider whether this API call is really needed.18 March 2022 - Updated rule severity and rule name.