So many of the security monitoring tools that purport to detect things like that only work if the attacker is brainless. Modern networks are complex enough where a clever attacker (like a professional ransomware gang) can make malicious traffic look like any other traffic.

Unless this was just a public S3 bucket, there was probably some lateral movement involved, and I'd say time/money would be better spent reducing that particular risk in the future.