Usando AWS re:Post, accetti AWS re:Post Termini di utilizzo

How would I use CloudFormation to configure GuardDuty findings export to S3?

0

I would like to take an IaaC approach to configuring GuardDuty to export its findings to a S3 bucket.

I've successfully managed to do this via button clicks in the console, examined the bucket policy and know the permissions for s3 and KMS needed to be given to GuardDuty for this.

However, when it comes to the CloudFormation template, the "AWS::GuardDuty::Detector" resource documentation describes a "FindingPublishingFrequency" property, but there doesn't seem to be a property for specifying which bucket the finding is supposed to be published into. Do I use the "Features" property? If so, what would the "CFNFeatureConfiguration" array I am supposed to specify look like?

1 Risposta
0

Hi,

One way to achieve what you want is to go via the events generated by GuardDuty on it findings

When you catch those events, you can start doing all kinds of advanced things to achieve your goal: write those events to SQS, trigger a Lambda reading the queue to write to S3, etc.

This article will detail the steps and provide code on how to achieve it: https://medium.com/@epselon/aws-guardduty-managed-setup-with-cloudformation-41a38e17aa2f

Best,

Didier

profile pictureAWS
ESPERTO
con risposta un anno fa

Accesso non effettuato. Accedi per postare una risposta.

Una buona risposta soddisfa chiaramente la domanda, fornisce un feedback costruttivo e incoraggia la crescita professionale del richiedente.

Linee guida per rispondere alle domande