2026/10/19 - Amazon GuardDuty - 3 updated api methods
Changes Adding a new Expected Bucket Owner optional field for GuardDuty publishing destination APIs
{'DestinationProperties': {'ExpectedBucketOwner': 'string'}}
Creates a publishing destination where you can export your GuardDuty findings. Before you start exporting the findings, the destination resource must exist.
See also: AWS API Documentation
Request Syntax
client.create_publishing_destination(
DetectorId='string',
DestinationType='S3',
DestinationProperties={
'DestinationArn': 'string',
'KmsKeyArn': 'string',
'ExpectedBucketOwner': 'string'
},
ClientToken='string',
Tags={
'string': 'string'
}
)
string
[REQUIRED]
The ID of the GuardDuty detector associated with the publishing destination.
To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API.
string
[REQUIRED]
The type of resource for the publishing destination. Currently only Amazon S3 buckets are supported.
dict
[REQUIRED]
The properties of the publishing destination, including the ARNs for the destination and the KMS key used for encryption.
DestinationArn (string) --
The ARN of the resource to publish to.
To specify an S3 bucket folder use the following format: arn:aws:s3:::DOC-EXAMPLE-BUCKET/myFolder/
KmsKeyArn (string) --
The ARN of the KMS key to use for encryption.
ExpectedBucketOwner (string) --
The 12-digit Amazon Web Services account ID of the account that owns the Amazon S3 bucket specified in the DestinationArn parameter.
When you provide this value, GuardDuty verifies that the specified account owns the bucket before it exports findings. If the account ID doesn't match the actual owner of the bucket, GuardDuty doesn't export findings to that bucket. This helps prevent GuardDuty from exporting your findings to a bucket that a different Amazon Web Services account owns (for example, if the original bucket was deleted and its name was later claimed by another account). If you don't specify this value, GuardDuty doesn't perform this verification. GuardDuty strongly recommends that you provide the expected bucket owner when possible.
When you update a publishing destination, omitting this field leaves the currently stored value unchanged. This field appears in the response only if it was provided when the publishing destination was created or updated.
For more information, see Verifying the Amazon S3 bucket owner in the Amazon GuardDuty User Guide.
string
The idempotency token for the request.
This field is autopopulated if not provided.
dict
The tags to be added to a new publishing destination resource.
(string) --
(string) --
dict
Response Syntax
{
'DestinationId': 'string'
}
Response Structure
(dict) --
DestinationId (string) --
The ID of the publishing destination that is created.
{'DestinationProperties': {'ExpectedBucketOwner': 'string'}}
Returns information about the publishing destination specified by the provided destinationId.
See also: AWS API Documentation
Request Syntax
client.describe_publishing_destination(
DetectorId='string',
DestinationId='string'
)
string
[REQUIRED]
The unique ID of the detector associated with the publishing destination to retrieve.
To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API.
string
[REQUIRED]
The ID of the publishing destination to retrieve.
dict
Response Syntax
{
'DestinationId': 'string',
'DestinationType': 'S3',
'Status': 'PENDING_VERIFICATION'|'PUBLISHING'|'UNABLE_TO_PUBLISH_FIX_DESTINATION_PROPERTY'|'STOPPED',
'PublishingFailureStartTimestamp': 123,
'DestinationProperties': {
'DestinationArn': 'string',
'KmsKeyArn': 'string',
'ExpectedBucketOwner': 'string'
},
'Tags': {
'string': 'string'
}
}
Response Structure
(dict) --
DestinationId (string) --
The ID of the publishing destination.
DestinationType (string) --
The type of publishing destination. Currently, only Amazon S3 buckets are supported.
Status (string) --
The status of the publishing destination.
PublishingFailureStartTimestamp (integer) --
The time, in epoch millisecond format, at which GuardDuty was first unable to publish findings to the destination.
DestinationProperties (dict) --
A DestinationProperties object that includes the DestinationArn and KmsKeyArn of the publishing destination.
DestinationArn (string) --
The ARN of the resource to publish to.
To specify an S3 bucket folder use the following format: arn:aws:s3:::DOC-EXAMPLE-BUCKET/myFolder/
KmsKeyArn (string) --
The ARN of the KMS key to use for encryption.
ExpectedBucketOwner (string) --
The 12-digit Amazon Web Services account ID of the account that owns the Amazon S3 bucket specified in the DestinationArn parameter.
When you provide this value, GuardDuty verifies that the specified account owns the bucket before it exports findings. If the account ID doesn't match the actual owner of the bucket, GuardDuty doesn't export findings to that bucket. This helps prevent GuardDuty from exporting your findings to a bucket that a different Amazon Web Services account owns (for example, if the original bucket was deleted and its name was later claimed by another account). If you don't specify this value, GuardDuty doesn't perform this verification. GuardDuty strongly recommends that you provide the expected bucket owner when possible.
When you update a publishing destination, omitting this field leaves the currently stored value unchanged. This field appears in the response only if it was provided when the publishing destination was created or updated.
For more information, see Verifying the Amazon S3 bucket owner in the Amazon GuardDuty User Guide.
Tags (dict) --
The tags of the publishing destination resource.
(string) --
(string) --
{'DestinationProperties': {'ExpectedBucketOwner': 'string'}}
Updates information about the publishing destination specified by the destinationId.
See also: AWS API Documentation
Request Syntax
client.update_publishing_destination(
DetectorId='string',
DestinationId='string',
DestinationProperties={
'DestinationArn': 'string',
'KmsKeyArn': 'string',
'ExpectedBucketOwner': 'string'
}
)
string
[REQUIRED]
The ID of the detector associated with the publishing destinations to update.
To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API.
string
[REQUIRED]
The ID of the publishing destination to update.
dict
A DestinationProperties object that includes the DestinationArn and KmsKeyArn of the publishing destination.
DestinationArn (string) --
The ARN of the resource to publish to.
To specify an S3 bucket folder use the following format: arn:aws:s3:::DOC-EXAMPLE-BUCKET/myFolder/
KmsKeyArn (string) --
The ARN of the KMS key to use for encryption.
ExpectedBucketOwner (string) --
The 12-digit Amazon Web Services account ID of the account that owns the Amazon S3 bucket specified in the DestinationArn parameter.
When you provide this value, GuardDuty verifies that the specified account owns the bucket before it exports findings. If the account ID doesn't match the actual owner of the bucket, GuardDuty doesn't export findings to that bucket. This helps prevent GuardDuty from exporting your findings to a bucket that a different Amazon Web Services account owns (for example, if the original bucket was deleted and its name was later claimed by another account). If you don't specify this value, GuardDuty doesn't perform this verification. GuardDuty strongly recommends that you provide the expected bucket owner when possible.
When you update a publishing destination, omitting this field leaves the currently stored value unchanged. This field appears in the response only if it was provided when the publishing destination was created or updated.
For more information, see Verifying the Amazon S3 bucket owner in the Amazon GuardDuty User Guide.
dict
Response Syntax
{}
Response Structure
(dict) --