Control: 1 GuardDuty should be enabled

Description

This control checks whether Amazon GuardDuty is enabled in your AWS account and Region.

While GuardDuty can be effective against attacks that an intrusion detection system would typically protect, it might not be a complete solution for every environment. This rule also does not check for the generation of alerts to personnel. For more information about GuardDuty, see the Amazon GuardDuty User Guide.

Remediation

To remediate this issue, you enable GuardDuty.

Refer here for more Getting started with GuardDuty.

Usage

Run the control in your terminal:

powerpipe control run aws_compliance.control.foundational_security_guardduty_1

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run aws_compliance.control.foundational_security_guardduty_1 --share

SQL

This control uses a named query:

select
  'arn:' || r.partition || '::' || r.region || ':' || r.account_id as resource,
  case
    when r.steampipe_available = false then 'skip'
    when r.region = any(array['af-south-1', 'ap-northeast-3', 'ap-southeast-3', 'eu-south-1', 'cn-north-1', 'cn-northwest-1', 'me-south-1', 'us-gov-east-1']) then 'skip'
    when r.opt_in_status = 'not-opted-in' then 'skip'
    when d.status = 'ENABLED' and d.master_account ->> 'AccountId' is null then 'ok'
    when d.status = 'ENABLED' and d.master_account ->> 'AccountId' is not null then 'info'
    else 'alarm'
  end as status,
  case
    when r.steampipe_available = false then r.region || ' is not available in the current connection configuration.'
    when r.region = any(array['af-south-1', 'ap-northeast-3', 'ap-southeast-3', 'eu-south-1', 'cn-north-1', 'cn-northwest-1', 'me-south-1', 'us-gov-east-1']) then r.region || ' region not supported.'
    when r.opt_in_status = 'not-opted-in' then r.region || ' region is disabled.'
    when d.status is null then 'No GuardDuty detector found in ' || r.region || '.'
    when d.status = 'ENABLED' and d.master_account ->> 'AccountId' is null then r.region || ' detector ' || d.title || ' enabled.'
    when d.status = 'ENABLED' and d.master_account ->> 'AccountId' is not null then r.region || ' detector ' || d.title || ' is managed by account ' || (d.master_account ->> 'AccountId') ||  ' via delegated admin.'
    else r.region || ' detector ' || d.title || ' disabled.'
  end as reason
  , r.region, r.account_id
from
  aws_region as r
  left join aws_guardduty_detector d on r.account_id = d.account_id and r.name = d.region;

Control: 1 GuardDuty should be enabled

Description

Remediation

Usage

SQL

Tags