A new option access_point_arn is being added to the AWS S3 input at elastic/beats#41495. Integrations that uses the input and can include this new option are:

• Amazon Security Lake
• AWS
• AWS Bedrock
• Custom AWS Logs
• Canva
• Carbon Black Cloud
• Cisco Umbrella
• Cloudflare Logpush
• Crowdstrike (only uses S3 input for SQS)
• F5 BIG-IP
• Imperva Cloud WAF
• Jamf Protect
• Lyve Cloud (only uses S3 input for third-party buckets)
• SentinelOne Cloud Funnel
• ServiceNow
• Sublime Security
• Symantec Endpoint Security
• Tanium
• Trellix EDR Cloud

This new option is included in 8.16.2 and 8.17.0.