⚠
Since GuardDuty is a regional service, you must apply this Terraform configuration on each region that you are using. Consider using the region argument in your provider definition and a variable to make your Terraform configuration rerunnable in other regions.
We can then use the [`aws_guardduty_organization_admin_account` resource](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/guardduty_organization_admin_account) to set the delegated administrator. However, I noticed the following in the **Audit** account:
* After this resource is created, GuardDuty will be enabled with both the foundational data sources and all protection plans enabled.
* When the resource is deleted, GuardDuty remains enabled.
These side effects are not desirable since we would ideally want full control over the lifecycle and configuration of GuardDuty in Terraform. To address this issue, we will preemptively enable GuardDuty in the **Audit** account using the [`aws_guardduty_detector` resource](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/guardduty_detector). We will also manage the protection plans using the [`aws_guardduty_detector_feature` resource](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/guardduty_detector_feature) in subsequent steps after we define the org-wide settings.
The resulting Terraform configuration should be defined as follows (pay special attention to the `provider` argument in each resource):
```dockerfile
data "aws_caller_identity" "audit" {
provider = aws.audit
}
resource "aws_guardduty_detector" "audit" {
provider = aws.audit
}
resource "aws_guardduty_organization_admin_account" "this" {
provider = aws.management
admin_account_id = data.aws_caller_identity.audit.account_id
depends_on = [aws_guardduty_detector.audit]
}
```
With the **Audit** account designated as the GuardDuty administrator, we can now manage the organization configuration.
## **Configuring organization auto-enable preferences**
GuardDuty distinguishes the foundational data sources settings from the protection plans settings. The former is managed using the [`aws_guardduty_organization_configuration` resource](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/guardduty_organization_configuration). In our case, we want to manage GuardDuty for all accounts (i.e. both new and existing accounts). The resulting Terraform configuration should thus look like the following:
```dockerfile
resource "aws_guardduty_organization_configuration" "this" {
provider = aws.audit
auto_enable_organization_members = "ALL"
detector_id = aws_guardduty_detector.audit.id
depends_on = [aws_guardduty_organization_admin_account.this]
}
```
Next, let's manage the protection plan configuration. For illustration, let's assume that we only want to enable only [EKS Audit Log Monitoring](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-eks-audit-log-monitoring.html). To ensure full configurability, we will define the setting for all protection plans using a variable:
```dockerfile
# Terraform configuration (.tf)
variable "guardduty_features" {
description = "An object map that defines the GuardDuty organization configuration."
type = map(object({
auto_enable = string
name = string
additional_configuration = optional(list(object({
auto_enable = string
name = string
})))
}))
}
```
```dockerfile
# Variable definition (.tfvars)
guardduty_features = {
s3 = {
auto_enable = "NONE"
name = "S3_DATA_EVENTS"
}
eks = {
auto_enable = "ALL"
name = "EKS_AUDIT_LOGS"
}
eks_runtime_monitoring = {
# EKS_RUNTIME_MONITORING is deprecated and should thus be explicitly disabled
auto_enable = "NONE"
name = "EKS_RUNTIME_MONITORING"
additional_configuration = [
{
auto_enable = "NONE"
name = "EKS_ADDON_MANAGEMENT"
},
]
}
runtime_monitoring = {
auto_enable = "NONE"
name = "RUNTIME_MONITORING"
additional_configuration = [
{
auto_enable = "NONE"
name = "EKS_ADDON_MANAGEMENT"
},
{
auto_enable = "NONE"
name = "ECS_FARGATE_AGENT_MANAGEMENT"
},
{
auto_enable = "NONE"
name = "EC2_AGENT_MANAGEMENT"
}
]
}
malware = {
auto_enable = "NONE"
name = "EBS_MALWARE_PROTECTION"
}
rds = {
auto_enable = "NONE"
name = "RDS_LOGIN_EVENTS"
}
lambda = {
auto_enable = "NONE"
name = "LAMBDA_NETWORK_LOGS"
}
}
```
⚠
The EKS_RUNTIME_MONITORING feature has been superseded by the RUNTIME_MONITORING feature, but to avoid perpetual differences in Terraform configuration, we must set its enablement state to NONE.
We can then use this variable with the [`for_each` meta-argument](https://developer.hashicorp.com/terraform/language/meta-arguments/for_each) with [the `aws_guardduty_organization_configuration_feature` resource](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/guardduty_organization_configuration_feature) as follows:
```dockerfile
resource "aws_guardduty_organization_configuration_feature" "this" {
provider = aws.audit
for_each = var.guardduty_features
auto_enable = each.value.auto_enable
detector_id = aws_guardduty_detector.audit.id
name = each.value.name
dynamic "additional_configuration" {
for_each = try(each.value.additional_configuration, [])
content {
auto_enable = additional_configuration.value.auto_enable
name = additional_configuration.value.name
}
}
depends_on = [aws_guardduty_organization_admin_account.this]
}
```
Lastly, we will circle back to recalibrating the protection plan settings for the **Audit** account itself. Let's piggyback on the same variable and use [the `aws_guardduty_detector_feature` resource](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/guardduty_detector_feature) to achieve this:
```dockerfile
resource "aws_guardduty_detector_feature" "audit" {
provider = aws.audit
for_each = var.guardduty_features
detector_id = aws_guardduty_detector.audit.id
name = each.value.name
status = each.value.auto_enable == "NONE" ? "DISABLED" : "ENABLED"
dynamic "additional_configuration" {
for_each = try(each.value.additional_configuration, [])
content {
status = additional_configuration.value.auto_enable == "NONE" ? "DISABLED" : "ENABLED"
name = additional_configuration.value.name
}
}
}
```