# ruleid: detected-aws-account-id
aws_account_id = 287139315271

# ruleid: detected-aws-account-id
aws_account_id:287139315271

{
    "version": "0",
    "id": "a76750eb-b69f-ae47-b183-4d3cb0700618",
    "detail-type": "AWS API Call via CloudTrail",
    "source": "aws.s3",
    # ruleid: detected-aws-account-id
    "account": "287139315271",
    "time": "2018-05-22T12:44:24Z",
    "region": "us-east-1",
    "resources": [],
    "detail": {
       "eventVersion": "1.05",
       "userIdentity": {},
       "eventTime": "2018-05-22T12:44:24Z",
       "eventSource": "s3.amazonaws.com",
       "eventName": "DeleteBucket",
       "awsRegion": "us-east-1",
       "sourceIPAddress": "209.6.231.175",
       "userAgent": "[S3Console/0.4, aws-internal/3]",
       "requestParameters": {},
       "responseElements": null,
       "additionalEventData": {
          "vpcEndpointId": "vpce-6d72a204"
       },
       "requestID": "51A7870C114C931C",
       "eventID": "d687e2af-5a29-4acb-bc41-6892b36420bf",
       "eventType": "AwsApiCall",
       "vpcEndpointId": "vpce-6d72a204"
    }
}

Mappings:
  ElbService:
    # https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-access-logs.html#access-logging-bucket-permissions
    us-east-1:
      # ruleid: detected-aws-account-id
      AccountId: "287139315271"

# ruleid: detected-aws-account-id
aws_account_id = "287139315271"

aws s3api put-bucket-inventory-configuration \
              --bucket my-bucket \
              --id 2 \
# ruleid: detected-aws-account-id
              --inventory-configuration '{"Destination": { "S3BucketDestination": { "AccountId": "287139315271", "Bucket": "arn:aws:s3:::my-bucket", "Format": "CSV" }}, "IsEnabled": true, "Id": "2", "IncludedObjectVersions": "Current", "Schedule": { "Frequency": "Daily" }}'


# ok: detected-aws-account-id
aws_account_id_fake:123456789012123
