GuardDuty detector disabled

이 제품은 선택한 Datadog 사이트에서 지원되지 않습니다. ().
이 페이지는 아직 한국어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우 언제든지 연락주시기 바랍니다.

Metadata

Id: a25cd877-375c-4121-a640-730929936fac

Cloud Provider: AWS

Platform: CloudFormation

Severity: Medium

Category: Observability

Learn More

Description

Amazon GuardDuty must be enabled to provide continuous threat detection and alerting. Disabling it can allow malicious activity to go undetected and delay incident response.

The Enable property on AWS::GuardDuty::Detector resources must be set to true. This rule flags AWS::GuardDuty::Detector resources where Enable is explicitly set to false.

Secure configuration example:

MyDetector:
  Type: AWS::GuardDuty::Detector
  Properties:
    Enable: true

Compliant Code Examples

AWSTemplateFormatVersion: "2010-09-09"
Resources:
    mydetector:
      Type: AWS::GuardDuty::Detector
      Properties:
          Enable: True
          FindingPublishingFrequency: FIFTEEN_MINUTES

{
  "document": [
    {
      "AWSTemplateFormatVersion": "2010-09-09",
      "Resources": {
        "mydetector2": {
          "Properties": {
            "Enable": true,
            "FindingPublishingFrequency": "FIFTEEN_MINUTES"
          },
          "Type": "AWS::GuardDuty::Detector"
        }
      },
      "id": "f63e21c6-c58e-45cf-b7b4-6b548d9f7674",
      "file": "C:\\Users\\foo\\Desktop\\Data\\yaml\\yaml.yaml"
    }
  ]
}

Non-Compliant Code Examples

{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Resources": {
    "mydetector4": {
      "Properties": {
        "Enable": false,
        "FindingPublishingFrequency": "FIFTEEN_MINUTES"
      },
      "Type": "AWS::GuardDuty::Detector"
    }
  }
}

AWSTemplateFormatVersion: "2010-09-09"
Resources:
  mydetector3:
    Type: AWS::GuardDuty::Detector
    Properties:
        Enable: False
        FindingPublishingFrequency: FIFTEEN_MINUTES