GuardDuty Centralized Enablement.

More Info:

This rule checks if Amazon GuardDuty is enabled in your AWS account and AWS Region. If you provide an AWS account for centralization, the rule evaluates the GuardDuty results in the centralized account. The rule is COMPLIANT when GuardDuty is enabled.

Risk Level

Low

Addresses

Security

Compliance Standards

CBP,RBI_MD_ITF

Triage and Remediation

Remediation

Using Console

Using CLI

To remediate the misconfiguration of GuardDuty Centralized Enablement for AWS Shield using AWS CLI, follow these steps:

List all regions where GuardDuty is not enabled:

aws guardduty list-detectors --region <region-name>

Enable GuardDuty in the desired region:

aws guardduty create-detector --enable --region <region-name>

Enable Centralized GuardDuty Management:
- Open the AWS Management Console.
- Go to the GuardDuty service.
- Click on the “Settings” tab.
- Enable the “Enable GuardDuty Centralized Management” option.
Enable AWS Shield Advanced:
- Open the AWS Management Console.
- Go to the AWS Shield service.
- Click on “Activate AWS Shield Advanced”.
- Follow the on-screen instructions to complete the activation.
Verify GuardDuty and AWS Shield configuration:
- Use the following command to verify that GuardDuty is enabled in all regions:
```
aws guardduty list-detectors
```
- Use the following command to verify that AWS Shield Advanced is enabled:
```
aws shield describe-attack
```

By following these steps, you can remediate the misconfiguration of GuardDuty Centralized Enablement for AWS Shield using AWS CLI.

Using Python

To remediate the “GuardDuty Centralized Enablement” misconfiguration for AWS Shield using Python, you can follow these steps:

Import the necessary Python libraries:

import boto3

Connect to AWS using the Boto3 library:

client = boto3.client('shield')

Disable GuardDuty Centralized Enablement:

response = client.update_subscription(
    AutoRenew=True,
    Enabled=False
)

Verify that GuardDuty Centralized Enablement has been successfully disabled:

if response['ResponseMetadata']['HTTPStatusCode'] == 200:
    print("GuardDuty Centralized Enablement has been successfully disabled.")
else:
    print("Failed to disable GuardDuty Centralized Enablement.")

By following these steps, you can remediate the “GuardDuty Centralized Enablement” misconfiguration for AWS Shield using Python.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

GuardDuty Centralized Enablement.

More Info:

Risk Level

Addresses

Compliance Standards

Triage and Remediation

Remediation

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

​More Info:

​Risk Level

​Addresses

​Compliance Standards

​Triage and Remediation

​Remediation

More Info:

Risk Level

Addresses

Compliance Standards

Triage and Remediation

Remediation