Guides
  1. aws policies
  2. Region

Amazon GuardDuty service is enabled

Risk Level: Low
Cloud Entity: Region
CloudGuard Rule ID: D9.AWS.VLN.03
Covered by Spectral: Yes
Category: Global

GSL LOGIC

Region should have guardDutyStatus='Enabled'

REMEDIATION

From Portal
Use following steps to enable Amazon GuardDuty

  1. Open the GuardDuty console at https://console.aws.amazon.com/guardduty/
  2. Choose Get Started.
  3. Choose Enable GuardDuty.

Note: If you previously signed in to the AWS Management Console using AWS account root user credentials, choose Sign in to a different account. If you previously signed in to the console using IAM credentials, choose Sign-in using root account credentials. Then choose Create a new AWS account.

From TF

resource "aws_guardduty_detector" "test" {
	+ enable = true
}

From Command Line
Run following command to create an Amazon GuardDuty detector.

aws guardduty create-detector --region AWS_region_name --enable

Note: Detector is an object to represent the AWS GuardDuty service. A detector must be created to make GuardDuty operational. --enable command syntax specifies that the detector is automatically enabled after creation.

References

  1. https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_settingup.html
  2. https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_findings.html
  3. https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/guardduty_detector
  4. https://awscli.amazonaws.com/v2/documentation/api/latest/reference/guardduty/create-detector.html

Region

Each Amazon EC2 Region is designed to be completely isolated from the other Amazon EC2 Regions. This achieves the greatest possible fault tolerance and stability.

Compliance Frameworks

  • AWS CIS Controls V 8
  • AWS CSA CCM v.4.0.1
  • AWS CloudGuard SOC2 based on AICPA TSC 2017
  • AWS CloudGuard Well Architected Framework
  • AWS HITRUST
  • AWS HITRUST v11.0.0
  • AWS ISO27001:2022
  • AWS ITSG-33
  • AWS MAS TRM Framework
  • AWS MITRE ATT&CK Framework v10
  • AWS MITRE ATT&CK Framework v11.3
  • AWS NIST 800-53 Rev 5
  • AWS PCI-DSS 4.0
  • CloudGuard AWS All Rules Ruleset

Updated 7 months ago