AWS S3 Bucket Made Public By ACL
This rule detects when an AWS S3 bucket's Access Control List (ACL) is modified to make the bucket publicly accessible. Specifically, it looks for `PutBucketAcl` events in AWS CloudTrail where the grantee URI is set to either "AuthenticatedUsers" (meaning any AWS user can access it) or "AllUsers" (meaning anyone on the internet can access it). This action indicates a potential misconfiguration or malicious activity leading to data exposure.
YARA-L
