This message was deleted.
# awss
sparse-intern-71089
03/01/2023, 2:19 AMThis message was deleted.
l
little-cartoon-10569
03/01/2023, 2:25 AMNo. If you use Organizations, you could load yours and iterate over the accounts, but presumably you don't want to enable Guard Duty for all accounts (no one is that rich!). List the accountIds you want to use as an array in you Pulumi stack config file.
❤️ 1
f
freezing-umbrella-71201
03/01/2023, 2:32 AMHey, thank you for your reply!!
we dont have that many accounts tbh - but we do use organisations so I can add that for now!
What would the recommended method be? I need to feed GuardDuty findings into CloudWatch logs and was told to also include member accounts of our org
l
little-cartoon-10569
03/01/2023, 2:38 AMGuard Duty is pretty expensive. The accounts that can affect your "live" systems, and accounts with direct access to them, are good places to start with Guard Duty. If you have an account that devs use for deploying test environments, or accounts that just contain non-critical resources (maybe your VPC logs from other systems? stuff like that), they don't need Guard Duty.
little-cartoon-10569
03/01/2023, 2:39 AMIf you're getting things going, start with a collection of account ids, and add Organizations later. There's no real value in that, it's just an exercise in completeness.
little-cartoon-10569
03/01/2023, 2:40 AMThe sooner you have 1 account with Guard Duty set up using Pulumi, the better. Then iterate and improve.
f
freezing-umbrella-71201
03/01/2023, 2:43 AMThank you - some really good notes here - ill give it a go with setting up 1 account then try and split the account types up! cheers
freezing-umbrella-71201
03/01/2023, 2:43 AM🙂
freezing-umbrella-71201
03/02/2023, 1:27 AMHey @little-cartoon-10569 I had this setup with just one account ID earlier today and now have a need to have it managed by a organization so all member accounts are affected. In my code below, I create the organizationConfig but when running, I get this error
BadRequestException: The request is rejected because an invalid or out-of-range value is specified as an input parameter. Copy code
for (const region of regions) {
const provider = new aws.Provider(region, { region });
const detector = new aws.guardduty.Detector(
region,
{
enable: true,
findingPublishingFrequency: "FIFTEEN_MINUTES",
},
{ provider }
);
new aws.guardduty.OrganizationConfiguration(
`guardduty-organization-${region}`,
{
autoEnable: true,
detectorId: detector.id,
datasources: {
malwareProtection: {
scanEc2InstanceWithFindings: {
ebsVolumes: { autoEnable: true },
},
},
s3Logs: {
autoEnable: true,
},
},
},
{ provider }
);
}freezing-umbrella-71201
03/02/2023, 1:28 AMthe code for the cloudwatch EventRule is the same except removal of
accountIdl
little-cartoon-10569
03/02/2023, 2:16 AMI'm not sure where the error message is coming from. It might be that "findingPublishingFrequency" doesn't like that constant?
little-cartoon-10569
03/02/2023, 2:17 AMI'm not really an expert on Organizations, but as I understand it, the Organization is only in your org account. Would that mean that OrganizationConfiguration should always be in that account? You may need to read up on that. If it is supposed to always be in the org account, then you're passing in the wrong provider there.
little-cartoon-10569
03/02/2023, 2:18 AMYea, the API docs seem to imply that you're using the wrong provider:
The AWS account utilizing this resource must have been assigned as a delegated Organization administrator account, e.g., via the aws.guardduty.OrganizationAdminAccount resource.
little-cartoon-10569
03/02/2023, 2:18 AMHowever that won't fix your current error, I think. It's just another error waiting for you later 🙂
4 Views