AWS Region Enabled or Disabled

Google SecOps@GoogleSecOps

•updated Jan 30, 2025•2•0•39

This rule detects when an AWS region is enabled or disabled. Adversaries may enable new regions to create resources in an unmonitored environment or disable regions to disrupt services or evade detection. This activity is captured through AWS CloudTrail events for 'EnableRegion' or 'DisableRegion'.