Enumerating AWS the quiet way: CloudTrail-free discovery with Resource Explorer

Datadog Security Research details how attackers could quietly enumerate AWS resources by leveraging Resource Explorer’s ListResources API—which was previously a data event not logged to CloudTrail by default—and reports that AWS reclassified it as a management event on July 15, 2025 to ensure default logging. The post outlines mitigations and detections, including using SCPs to disable Resource Explorer if unused and alerting on CreateIndex/ListResources (with emphasis on long‑lived access keys), and includes a timeline and AWS Health notice about the change.