AWS Firehose S3 Bucket Hijacking via DeleteBucket then UpdateDestination

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•3

Detects a sequence of events where an Amazon S3 bucket is deleted, followed within one hour by the creation of an Amazon Data Firehose delivery stream or an update to a destination using the same bucket name. This pattern indicates a potential bucket name hijacking attempt, where an attacker recreates the deleted bucket to intercept or redirect data streams processed by Firehose.