Change log for AWS_CLOUDTRAIL

Date	Changes
2024-03-04	Enhancement: - For logs having "eventName" as "TerminateInstances": - Mapped "responseElements" JSON Object to "target.resource.attribute.labels". - Mapped "sessionCredentialFromConsole" to "target.resource.attribute.labels". - For logs where "eventName" is "CreateDomain","DeleteDomain","CreateCollection", "DeleteCollection","CreateDBCluster","DeleteDBCluster","StopDBCluster","StartDBCluster", "CreateCluster","DeleteCluster", "ListClusters", "CreateNodegroup", "DeleteNodegroup", "RegisterCluster", "DeregisterCluster", "DescribeCluster", "DescribeNodegroup", "ListNodegroups". - Set "target.resource.resource_type" to "CLUSTER".
2023-11-21	Enhancement: - Mapped "awsRegion" to "target.location.name". - For logs having "eventName" as "PutBucketAcl", when "userIdentity.arn" is not present, then modify "metadata.event_type" to "STATUS_UPDATE". - For logs having "eventName" as prefix "Get", "List", "Describe", "Detect", "Query", "Check", "Decode", "Decrypt", "Download", "Retrieve", "Read", "Discover", "Lookup", "Preview", "Scan", "Select", "Classify", "Show", "View": - Set "metadata.event_type" to "RESOURCE_READ". - For logs having "eventName" as prefix "Delete", "Terminate": - Set "metadata.event_type" to "RESOURCE_DELETION". - For logs having "eventName" as prefix "Create", "Put", "Import", "Generate", "Allocate": - Set "metadata.event_type" to "RESOURCE_CREATION". - For logs having "eventName" as prefix "Start", "Activate", "Reboot", "Initialize", "New": - Set "metadata.event_type" to "STATUS_STARTUP". - For logs having "eventName" as prefix "Stop", "Cancel", "Disconnect": - Set "metadata.event_type" to "STATUS_SHUTDOWN". - For logs having "eventName" as prefix "Test", "Accept", "Notify", "Request", "Validate", "Confirm", "Reject", "Verify", "Authorize", "Complete": - Set "metadata.event_type" to "STATUS_UPDATE". - For logs having "eventName" as prefix "Assume", "ConsoleLogin": - Set "metadata.event_type" to "USER_LOGIN". - For logs having "eventName" as "SendHeartbeat": - Set "metadata.event_type" to "STATUS_HEARTBEAT". - For logs haveing "eventName" as prefix "Initiate", "Publish", "Replace", "Resume", "Run", "Submit", "Suspend", "Alter", "Increase", "Invite", "Provision", "Refresh", "Report", "Upgrade", "Abort", "Apply", "Backup", "Decrease", "Merge", "Retry", "Rotate", "Rotation", "Transfer", "Unassign", "Analyze", "Archive", "Beta_", "Clear", "Configure", "Confirm_", "Do", "Evaluate", "Failover", "Forgot", "Lock", "Migrate", "O", "Process", "Promote", "Release", "Renew", "Sign", "Unarchive", "Undeprecate", "Unlock", "Acknowledge", "Approve", "Connect", "Continue", "Decline", "Deploy", "Diagnostic", "Drop", "Exit", "Finalize", "Flush", "Forget", "Grant", "Issue", "Logout", "Move", "Opt", "Pause", "Rebuild", "Redeem", "Replicate", "Restart", "S", "Save", "Subscribe", "Sync", "Unlink", "Unsubscribe", "Unsuspend", "Allow", "Ato", "Back", "Backtrack", "Bid", "Bind", "Build", "Bundle", "Clone", "Close", "Cognito", "Console", "Dispose", "Dissociate", "End", "Enroll", "Enter", "Environment", "Event_", "Exclude", "Global", "Include", "Index", "Insert", "Install", "Invalidate", "Join", "Leave", "Load", "Managed", "Mark", "Monitor", "Peer", "Persist", "Prepare", "Pubkey", "Purge", "Push", "Rebalance", "Record", "Recovery", "Redact", "Refuse", "Reinvite", "Reload", "Rename", "Respond", "Resync", "Retire", "Reverse", "Rollback", "Schedule", "Secret", "Shutdown", "Signal", "Skip", "Split", "Stream", "Swap", "Switch", "Toggle", "Token_", "Translate", "Trim", "Unauthorize", "Undeploy", "Unmonitor", "Unpeer", "Use": - Set "metadata.event_type" to "RESOURCE_WRITTEN". - For logs haveing "eventName" as prefix "Update", "Associate", "Disassociate", "Modify", "Set", "Register", "Deregister", "Add", "Remove", "Enable", "Disable", "Send", "Restore", "Reset", "Attach", "Detach", "Export", "Copy", "Tag", "Untag", "Execute", "Purchase", "Allocate", "Deactivate", "Post", "Resend", "Upload", "Assign", "Change", "Define", "Deprecate", "Invoke", "Revoke: - Set "metadata.event_type" to "RESOURCE_PERMISSIONS_CHANGE".
2023-11-11	Enhancement: - Initialize variables to null or empty, to avoid duplicate mappings. - When "requestParameters.tagSpecificationSet.items.key" is "Hostname" , map to "target.hostname".
2023-10-27	Enhancement: For logs having "eventName" as "AssociateIamInstanceProfile": - Mapped "responseElements.AssociateIamInstanceProfileResponse.iamInstanceProfileAssociation.instanceid" to "target.resource.name". - Mapped "responseElements.AssociateIamInstanceProfileResponse.iamInstanceProfileAssociation.instanceid" to "target.resource.product_object_id". - Set "metadata.event_type" to "RESOURCE_PERMISSIONS_CHANGE". - Set "target.resource.resource_type" to "ACCESS_POLICY". For logs having "eventName" as "DisassociateIamInstanceProfile": - Mapped "responseElements.DisassociateIamInstanceProfileResponse.iamInstanceProfileAssociation.instanceid" to "target.resource.name". - Mapped "responseElements.DisassociateIamInstanceProfileResponse.iamInstanceProfileAssociation.instanceid" to "target.resource.product_object_id". - Set "metadata.event_type" to "RESOURCE_PERMISSIONS_CHANGE". - Set "target.resource.resource_type" to "ACCESS_POLICY". For logs having "eventName" as "ReplaceIamInstanceProfileAssociation": - Mapped "responseElements.ReplaceIamInstanceProfileAssociationResponse.iamInstanceProfileAssociation.instanceid" to "target.resource.name". - Mapped "responseElements.ReplaceIamInstanceProfileAssociationResponse.iamInstanceProfileAssociation.instanceid" to "target.resource.product_object_id". - Set "metadata.event_type" to "RESOURCE_PERMISSIONS_CHANGE". - Set "target.resource.resource_type" to "ACCESS_POLICY". Mapped "requestParameters" and "responseElements" JSON Object to "target.resource.attribute.labels". Corrected typo error for "req.userIdentity.userName" from "req.userIdentity.username".
2023-10-13	Enhancement: - For logs having "eventName" as "UpdateDetector": - Mapped "requestParameters.features.name" and "requestParameters.features.status" to "target.resource.attribute.labels". - For logs having "eventName" as "SendCommand": - Mapped "requestParameters.documentName" to "target.resource.product_object_id". - Mapped "responseElements.command.commandId" to "target.process.product_specific_object.id". - Mapped "metadata.event_type" to "PROCESS_LAUNCH". - Mapped "requestParameters.documentName" to "target.resource.name". - Mapped all the parameters in "requestParameters" and "responseElements" to "target.resource.attribute.labels". - For logs having "eventName" as "createAccountResult" map "event_type" as "USER_RESOURCE_ACCESS". - For logs having "eventName" as "createAccount" map "event_type" as "RESOURCE_CREATION".
2023-09-30	Enhancement: Add new mappings for the following fields: - Mapped "req.requestParameters.durationSeconds" to "target.resource.attribute.labels". - Mapped "req.requestParameters.policyArns" to "target.resource.attribute.labels". - For logs having "eventName" as "GetParameter", "GetParameters", "GetParameterHistory", "GetParametersByPath", "DescribeParameters": - Mapped "metadata.event_type" to "RESOURCE_READ". - Mapped "req.requestParameters.withDecryption" to "security_result.detection_fields". - For logs having "eventName" as "DeleteParameters","DeleteParameter", set "metadata.event_type" to "RESOURCE_DELETION". - For logs having "eventName" as "PutParameter", set "metadata.event_type" to "RESOURCE_PERMISSIONS_CHANGE". - For logs having "eventName" as "EnableRegion" or "DisableRegion", set "target.resource.name" from "req.requestParameters.map.RegionName". - For logs having "eventName" as "GetFederationToken": - Mapped "metadata.event_type" to "RESOURCE_READ". - Mapped "req.responseElements.federatedUser.arn" to "target.resource.name". - Mapped "req.responseElements.federatedUser.federatedUserId" to "target.user.userid". - Mapped "req.responseElements.packedPolicySize" to "security_result.detection_fields". - Mapped "req.responseElements.credentials.sessionToken" to "security_result.detection_fields".
2023-09-15	Enhancement: Add new mappings for the following fields: - Mapped 'requestParameters.userName' to 'target.user.user_display_name'. - Mapped 'additionalEventData.SamlProviderArn' to 'additional.fields'. - Mapped 'eventSource' to 'metadata.ingestion_labels'. - When value of 'requestParameters.tagSpecificationSet.items.tags.key' is 'Name', then mapped 'requestParameters.tagSpecificationSet.items.tags.value' to 'target.resource.name'.
2023-08-24	Enhancement: - For logs having "eventName" as "CreateSubnet", set "metadata.event_type" to "RESOURCE_CREATION". - Mapped "req.responseElements.subnet.subnetId" to "target.resource.attribute.labels". - Mapped "req.requestParameters.cidrBlock" to "target.resource.attribute.labels". - For logs having "eventName" as "DeleteSubnet", set "metadata.event_type" to "RESOURCE_DELETION". - Mapped "req.requestParameters.subnetId" to "target.resource.attribute.labels".
2023-08-24	Enhancement: - For logs having "eventName" as "CreateSubnet", set "metadata.event_type" to "RESOURCE_CREATION". - Mapped "req.responseElements.subnet.subnetId" to "target.resource.attribute.labels". - Mapped "req.requestParameters.cidrBlock" to "target.resource.attribute.labels". - For logs having "eventName" as "DeleteSubnet", set "metadata.event_type" to "RESOURCE_DELETION". - Mapped "req.requestParameters.subnetId" to "target.resource.attribute.labels".
2023-08-16	Enhancement: - For logs having 'eventName' as 'DeleteSecret', mapped 'responseElements.arn' to 'target.resource.name'.
2023-08-02	Enhancement: - For logs having 'eventName' as 'CreateTags', mapped 'metadata.event_type' to 'RESOURCE_WRITTEN'. - Mapped 'responseElements.description' ,'requestParameters.name','requestParameters.tagSet.items', 'requestParameters.attributeType' to "target.resource.attribute.labels". - Set "metadata.event_type" to "RESOURCE_CREATION" for logs having the following "eventName": "CreateNetworkAcl","CreateVolume","CreatePublishingDestination","CreateIPSet","CreateThreatIntelSet", "CreateAddon","CreateRepository","CreateStack","CreateDomain","CreateCollection","CreateTable", "CreateDBInstance","CreateDBCluster","CreateDBSnapshot","CreateDBClusterSnapshot","PutConfigRule", "PutDeliveryChannel","CreateListener","CreateLoadBalancer","PutLoggingConfiguration","CreateTargetGroup", "CreateWebACL","RequestCertificate","CreateCluster" - Set "metadata.event_type" to "RESOURCE_WRITTEN for logs having the follow "eventName": "MoveAccount","PutEventSelectors","PutInsightSelectors","UpdateIPSet","UpdateThreatIntelSet","CreateTags", "UpdateTable","ModifyDBInstance","StopDBInstance","StartDBInstance","RebootDBInstance", "StartDBCluster","StopDBCluster","ModifyDBSnapshotAttribute","ModifyDBClusterSnapshotAttribute", "AddListenerCertificates","ModifyLoadBalancerAttributes","SetSubnets","SetSecurityGroups", "ModifyListener","UpdateWebACL","ResendValidationEmail","ModifyInstanceAttribute", "StopInstances","StartInstances","RebootInstances" - Set 'metadata.event_type' to 'RESOURCE_WRITTEN' for logs having the following "eventName". "DeletePublishingDestination","DeleteIPSet","DeleteThreatIntelSet","DeleteRepository", "DeleteStack","DeleteCollection","DeleteDomain","DeleteTable","DeleteDBInstance","DeleteDBCluster", "DeleteDBSnapshot","DeleteDBClusterSnapshot","DeleteConfigRule","DeleteEvaluationResults", "DeleteTargetGroup","DeleteLoadBalancer","DeleteListener","DeleteLoggingConfiguration", "DeleteWebACL","DeleteCertificate","DeleteCluster" - Set "metadata.event_type" to "RESOURCE_PERMISSIONS_CHANGE" for logs having the following "eventName": "AssociateWebACL","DisassociateWebACL","AttachGroupPolicy","PutBucketAcl" - Set "metadata.event_type" to "RESOURCE_READ" for logs having the following "eventName": "GetPasswordData","GetSessionToken" - Mapped 'target.resource.resource_type' and other unmapped fields for the above mentioned event names.
2023-07-18	Enhancement: - For logs with the following "eventName", mapped "metadata.event_type" to "RESOURCE_CREATION". "EnableMacie","ConnectDirectory","RunInstances","CreateImage","CreateOrganization", "CreateNetworkInterface", "StartSSO","CreateEmailIdentity","VerifyDomainIdentity","VerifyDomainDkim","VerifyEmailIdentity", "CreateConfigurationSet","CreateSecret","ImportKeyPair","CreateAlias","CreateKey","CreateOrganizationalUnit", "CreateNetworkAcl","CreateVolume","CreatePublishingDestination","CreateIPSet","CreateThreatIntelSet" - For logs with the following "eventName", mapped "metadata.event_type" to "RESOURCE_WRITTEN". "UpdateMacieSession","PutAccountSendingAttributes","PutConfigurationSetSendingOptions","UpdateAccountSendingEnabled", "UpdateConfigurationSetSendingEnabled","UpdateSecret","DisableKey","EnableKey","CancelKeyDeletion", "MoveAccount","PutEventSelectors","PutInsightSelectors","UpdateIPSet","UpdateThreatIntelSet" - For logs with the following "eventName", mapped "metadata.event_type" to "RESOURCE_DELETION". "DeleteSnapshot","DeleteDetector","DeleteFlowLogs","DeregisterImage","TerminateInstances", "RESOURCE_DELETION", "DeleteNetworkInterface","DeleteSSO","DeleteBucketPublicAccessBlock","DeleteAccountPublicAccessBlock", "RemoveAccountFromOrganization","DeleteEmailIdentity","LeaveOrganization","DeleteConfigurationSet", "DeleteSecret","DeleteKeyPair","DeleteAlias","ScheduleKeyDeletion","DeleteNetworkAcl", "DeletePublishingDestination","DeleteIPSet","DeleteThreatIntelSet" - For logs with the following "eventName", mapped "metadata.event_type" to "RESOURCE_PERMISSIONS_CHANGE". "DetachRolePolicy","PutRolePolicy","PutResourcePolicy","PutCredentials","DeleteDirectory", "AuthorizeSecurityGroupEgress","AuthorizeSecurityGroupIngress","RevokeSecurityGroupEgress","RevokeSecurityGroupIngress", "ModifySnapshotAttribute","ModifyImageAttribute","CreateNetworkAclEntry","ReplaceNetworkAclAssociation","DeleteNetworkAclEntry" - Mapped 'target.resource.resource_type' and other unmapped fields for the above mentioned eventNames. - Added a null check before mapping field 'userIdentity.invokedBy'.
2023-07-06	Enhancement: - Added null check before mapping field "userIdentity.invokedBy". - Mapped "requestParameters.instanceType","requestParameters.instancesSet.items.0.minCount","requestParameters.instancesSet.items.0.maxCount" to "target.resource.attribute.labels".
2023-06-23	Enhancement: Mapped logs to more specific "metadata.event_type" based on the field 'eventName'. - Mapped "target.resource.resource_type" as "VIRTUAL_MACHINE". - Mapped "requestParameters.status", "responseElements.certificate.status" to "target.resource.attribute.labels". - Mapped "requestParameters.instanceId" to "target.resource_ancestors.product_object_id". - Mapped "requestParameters.userName" to "target.user.userid". - Mapped "target.resource.name" and "target.resource.product_object_id" based upon keys present under each "eventName". - Mapped "userIdentity.arn" to "principal.resource.name". - Mapped "userIdentity.accountId" to "principal.resource.product_object_id". - For logs having "eventName" as following, mapped "metadata.event_type" to "RESOURCE_CREATION". "CreateTrail","AllocateAddress","CreateVolume","CreateVirtualMFADevice","UploadSigningCertificate", "CreateAccessKey","UploadSSHPublicKey","CreateServiceSpecificCredential","UploadCloudFrontPublicKey", "CreateAnalyzer","CreateSAMLProvider","PutConfigurationRecorder","CreateRole","CreateInstanceProfile", "CreateExportTask","CreateLogGroup","EnableSecurityHub","CreateEnvironment","CreateSession","CreateServiceLinkedRole", "CreateSnapshot","CreateKeyPair","CreateSecurityGroup","CreateDetector","CreateFlowLogs", "EnableMacie","ConnectDirectory","RunInstances","CreateImage","CreateOrganization" - For logs having "eventName" as following, mapped "metadata.event_type" to "RESOURCE_WRITTEN". "StartLogging","StopLogging","AssociateAddress","DisassociateAddress","DetachVolume", "AttachVolume","ModifyVolume","EnableMFADevice","ResyncMFADevice","UpdateSigningCertificate", "UpdateAccessKey","UpdateSSHPublicKey","ResetServiceSpecificCredential","UpdateServiceSpecificCredential", "UpdateCloudFrontPublicKey","DisableRegion","EnableRegion","UpdateSAMLProvider","StartConfigurationRecorder", "StopConfigurationRecorder","PutRetentionPolicy","PutDataProtectionPolicy","UpdateDetector","UpdateMacieSession" - For logs having "eventName" as following, mapped "metadata.event_type" to "RESOURCE_DELETION". "DeleteTrail","ReleaseAddress","DeleteVolume","DeactivateMFADevice","DeleteVirtualMFADevice", "DeleteSigningCertificate","DeleteAccessKey","DeleteSSHPublicKey","DeleteServiceSpecificCredential", "DeleteCloudFrontPublicKey","DeleteAnalyzer","DeleteSAMLProvider","DeleteConfigurationRecorder", "DeletePolicy","DeleteRole","DeleteInstanceProfile","DeleteLogGroup","DisableSecurityHub","DisableMacie", "DeleteSnapshot","DeleteDetector","DeleteFlowLogs","DeregisterImage","TerminateInstances" - For logs having "eventName" as following, mapped "metadata.event_type" to "RESOURCE_PERMISSIONS_CHANGE". "AttachUserPolicy","DetachUserPolicy","PutUserPolicy","DeleteUserPolicy", "PutUserPermissionsBoundary","DeleteUserPermissionsBoundary","AttachRolePolicy", "DetachRolePolicy","PutRolePolicy","PutResourcePolicy","PutCredentials","DeleteDirectory"
2023-06-09	Enhancement: - Modified the regex to identify the JSON Array logs.
2023-06-07	Enhancement: - Mapped all the "principal.user" fields to "target.user" for "eventName" as "ConsoleLogin".
2023-05-26	Enhancement: Parsed logs of different josn pattern. - Mapped "cipherSuite" to "network.tls.cipher". - Mapped "requestID" to "target.resource.attribute.labels". - Mapped "assumedRoleId" to "security_result.about.resource.name". - Mapped "roleSessionName" to "target.resource.name". - Mapped "roleArn" to "target.resource.product_object_id". - Mapped "userAgent" to "network.http.user_agent". - Mapped "sourceIPAddress" to "principal.ip". - Mapped "sessionIssuer.userName" to "target.user.user_display_name". - Mapped "sessionIssuer.principalId" to "target.user.userid". - Mapped "userIdentity.accessKeyId" to "target.resource.product_object_id". - Mapped "userIdentity.arn" to "security_result.about.resource.id". - Mapped "req.detail.Longitude" to "_principal.location.region_longitude". - Mapped "req.detail.Latitude" to "_principal.location.region_latitude". - Mapped "detail.resourceType" to "target.resource.resource_subtype". - Set "security_result.alert_state" to "ALERTING". - Mapped "req.detail.recommenedRemediation" to "security_result.action_details". - Mapped "eventLog.detail.eventName" to "metadata.product_event_type".
2023-02-23	Enhancement: - Mapped "requestParameters.principalArn" to "principal.resource.name". - Mapped "resources.ARN" to "about.resource.name".
2022-11-24	Fix: - Parsed new format logs that has configurationItem by mapping following fields. - Mapped "configurationItem.awsAccountId" to "principal.user.userid". - Mapped "configurationItem.resourceId" to "target.resource.id". - Mapped "configurationItem.resourceType" to "target.resource.resource_subtype" - Mapped "configurationItem.awsRegion" to "target.location.country_or_region". - Mapped "configurationItem.configurationItemCaptureTime" to "target.asset.attribute.creation_time". - Mapped "configurationItem.configurationItemStatus" to "target.asset.attribute.labels". - Mapped "configurationItems.ARN" to "target.resource.attribute.labels". - Mapped "configurationItems.availabilityZone" to "target.resource.attribute.cloud.availability_zone". - Mapped "configurationItems.awsRegion" to "target.location.country_or_region". - Mapped "configurationItems.awsAccountId" to "principal.user.userid". - Mapped "configurationItems.configuration.activityStreamStatus" to "target.resource.attribute.labels". - Mapped "configurationItems.configuration.allocatedStorage" to "target.resource.attribute.labels". - Mapped "configurationItems.configuration.autoMinorVersionUpgrade" to "target.resource.attribute.labels". - Mapped "configurationItems.configuration.backupRetentionPeriod" to "target.resource.attribute.labels". - Mapped "configurationItems.configuration.copyTagsToSnapshot" to "target.resource.attribute.labels". - Mapped "configurationItems.configuration.dbClusterResourceId" to "target.resource.product_object_id". - Mapped "configurationItems.configuration.masterUsername" to "principal.user.user_display_name". - Mapped "configurationItems.resourceName" to "target.resource.name".
2022-10-13	Enhancement: - For 'eventName': 'CreateAccessKey' mapped the field 'responseElements.accessKey.accessKeyId' to 'target.resource.product_object_id'. - For 'eventName': 'UpdateAccessKey' mapped the field 'requestParameters.accessKeyId' to 'target.resource.product_object_id'. - For 'eventName': 'DeleteAccessKey' mapped the field 'requestParameters.accessKeyId' to 'target.resource.product_object_id'. - For 'eventName': 'CreateUser' mapped the field 'responseElements.user.userId' to 'target.user.product_object_id'. - Mapped the field 'eventTime' to 'metadata.collected_timestamp'.
2022-07-27	Enhancement: - Added eventType "QueryDatabase" and mapped it's fields. - Modified conditions for principal.ip or principal.host for handling new logs. - Changed the mapping of "requestParameters.roleArn", "requestParameters.registryId", "resources.accountId" from "target.resource.id" to "target.resource.product_object_id". - Modified the parsing condition for "req_params" to extract the values.
2022-07-08	Enhancement: - Modified mapping for "req.requestParameters.roleName" from "target.user.role_name" to "target.user.attribute.roles".
2022-07-06	- Changed mapping of "req.awsRegion" from "_principal.location.country_or_region" to "_principal.location.name". - Modified event_type from "GENERIC_EVENT" to "USER_LOGIN" for eventName "AssumeRole". - Modified event_type from "GENERIC_EVENT" to "USER_RESOURCE_ACCESS" for eventNAme "PutImage" or "GetDownloadUrlForLayer" or "BatchGetImage". - Modified event_type from "GENERIC_EVENT" to "USER_RESOURCE_DELETION" for eventName "DeleteNetworkInterface".
2022-06-06	For eventName "CreateUser/DeleteUser", modified condition for handling src mapping as existing one failed for new logs. Modified puserId field to handle new unparsed log.
2022-05-27	Enhancement - Modified the value stored in metadata.product_name to 'AWS CloudTrail'.
2022-05-27	Enhancement - Modified the value stored in metadata.product_name to 'AWS CloudTrail'.
2022-04-13	Enhancement to map following raw logs elements to UDM elements: Mapped field "requestParameters.PublicAccessBlockConfiguration.IgnorePublicAcls", "requestParameters.CreateAccessPointRequest.PublicAccessBlockConfiguration.RestrictPublicBuckets", "requestParameters.CreateAccessPointRequest.PublicAccessBlockConfiguration.BlockPublicPolicy", "requestParameters.CreateAccessPointRequest.PublicAccessBlockConfiguration.BlockPublicAcls", "requestParameters.CreateAccessPointRequest.PublicAccessBlockConfiguration.IgnorePublicAcls", "additionalEventData.configRuleInputParameters.RestrictPublicBuckets", "additionalEventData.configRuleInputParameters.BlockPublicPolicy", "additionalEventData.configRuleInputParameters.BlockPublicAcls", "additionalEventData.configRuleInputParameters.IgnorePublicAcls" to "target.resource.attribute.labels".