Skip to content
TheCloud.Events

DeleteDeliveryChannel

AWS

DeleteDeliveryChannel

service: AWS - Config
tactics:
Defense Impairment
techniques:
T1685
tags:
AWS Config

Event

Deletes the AWS Config delivery channel, stopping delivery of configuration snapshots and change notifications to S3 or SNS.

Security Context

  • Impairing defenses allows adversaries to operate freely by removing security controls that would otherwise detect or block their activity.

Log Source

CloudTrail

Sample Event

Adversarial. Draco deletes the Config delivery channel default, breaking the pipe that ships configuration snapshots and change notifications to S3 + SNS. Even if the recorder is still running, downstream consumers go silent. T1685.

{
  "eventVersion": "1.09",
  "userIdentity": {
    "type": "IAMUser",
    "principalId": "AIDADRAC0MALF0YBADGY",
    "arn": "arn:aws:iam::555123456789:user/draco",
    "accountId": "555123456789",
    "accessKeyId": "AKIADRAC0MALF0YEXAMP5",
    "userName": "draco",
    "sessionContext": {
      "attributes": {
        "creationDate": "2026-04-15T19:02:11Z",
        "mfaAuthenticated": "false"
      }
    }
  },
  "eventTime": "2026-04-15T19:44:21Z",
  "eventSource": "config.amazonaws.com",
  "eventName": "DeleteDeliveryChannel",
  "awsRegion": "us-east-1",
  "sourceIPAddress": "203.0.113.66",
  "userAgent": "aws-cli/1.18.147 Python/3.7.10 Linux/5.4.0-1045-aws botocore/1.18.6",
  "requestParameters": {
    "deliveryChannelName": "default"
  },
  "responseElements": null,
  "requestID": "90000000-0000-4000-8000-000011011010",
  "eventID": "90000000-0000-4000-8000-000011011011",
  "readOnly": false,
  "eventType": "AwsApiCall",
  "managementEvent": true,
  "recipientAccountId": "555123456789",
  "eventCategory": "Management",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "config.us-east-1.amazonaws.com"
  }
}

MITRE ATT&CK Mapping

Tactics: Defense Impairment

Techniques:
  • T1685 — Disable or Modify Tools — Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities. This may include stopping spec...
shares T1685 — Disable or Modify Tools
ArchiveFindings CreateFilter CreateIPSet DeleteAccessKey DeleteAlarms DeleteBucket DeleteBucketPolicy DeleteConfigRule +56 more
same service (AWS - Config)
DeleteConfigurationRecorder StopConfigurationRecorder