diff --git a/detections/cloud/asl_aws_disable_bucket_versioning.yml b/detections/cloud/asl_aws_disable_bucket_versioning.yml
index c72b258841..37abd078c7 100644
--- a/detections/cloud/asl_aws_disable_bucket_versioning.yml
+++ b/detections/cloud/asl_aws_disable_bucket_versioning.yml
@@ -43,7 +43,7 @@ tags:
   - name: user
     type: User
     role:
-    - Attacker
+    - Victim
   - name: src_ip
     type: IP Address
     role: