aws-guardduty-ip-set-object-content
Trusted IP set files can reveal private partners, scanner ranges, or sensitive network allowlists; the S3 object is the authoritative content.
Where it sits
| location | GetIPSet.Location -> S3 object body |
|---|
| location kind | data_record |
|---|
| data kinds | sensitive_data pii credential |
|---|
| emits edge | CanReadData |
|---|
| service | GuardDuty (aws:guardduty) |
|---|
Collection recipe
| access mode | indirect_destination |
|---|
| operation | GetIPSet then s3:GetObject |
|---|
| response path | Location -> S3 GetObject.Body |
|---|
| encoding | string |
|---|
| params | {"DetectorId": "\u003cdetector-id\u003e", "IpSetId": "\u003cip-set-id\u003e"} |
|---|
Required permissions
guardduty:GetIPSet
s3:GetObject
References