# guardduty-member

Configures GuardDuty protection features on a member account detector. Designed to be called once per member account, passing a provider alias that assumes a role in the target account.

## Prerequisites

- GuardDuty must already be enabled on the member account (via org auto-enroll or manually)
- A Terraform execution role must exist in the member account that the calling stack can assume
- The `guardduty` module must already be applied in the admin account

## Usage

```hcl
provider "aws" {
  alias  = "hca_prod"
  region = var.aws_region

  assume_role {
    role_arn = "arn:aws:iam::<account-id>:role/hca-iac-execution-role"
  }
}

module "guardduty_hca_prod" {
  source = "hcassc.jfrog.io/iac-tf-modules-virtual__governance/guardduty-member/aws"
  version = "1.0.0"

  providers = {
    aws.member = aws.hca_prod
  }

  features = {
    s3_data_events         = true
    eks_audit_logs         = true
    ebs_malware_protection = true
    rds_login_events       = false
    lambda_network_logs    = false
    eks_runtime_monitoring = false
    ai_protection          = false
    ai_analyst             = false
    runtime_monitoring = {
      enabled                      = true
      eks_addon_management         = false
      ecs_fargate_agent_management = false
      ec2_agent_management         = false
    }
  }
}
```

Only specify the features you want to manage. All default to `false`.

## Features

| Feature                  | Variable                     | Notes                                            |
| ------------------------ | ---------------------------- | ------------------------------------------------ |
| `S3_DATA_EVENTS`         | `s3_data_events`             |                                                  |
| `EKS_AUDIT_LOGS`         | `eks_audit_logs`             |                                                  |
| `EBS_MALWARE_PROTECTION` | `ebs_malware_protection`     |                                                  |
| `RDS_LOGIN_EVENTS`       | `rds_login_events`           |                                                  |
| `LAMBDA_NETWORK_LOGS`    | `lambda_network_logs`        |                                                  |
| `AI_PROTECTION`          | `ai_protection`              |                                                  |
| `AI_ANALYST`             | `ai_analyst`                 |                                                  |
| `RUNTIME_MONITORING`     | `runtime_monitoring.enabled` | Mutually exclusive with `EKS_RUNTIME_MONITORING` |
| `EKS_RUNTIME_MONITORING` | `eks_runtime_monitoring`     | Mutually exclusive with `RUNTIME_MONITORING`     |

## Runtime monitoring

`RUNTIME_MONITORING` and `EKS_RUNTIME_MONITORING` are mutually exclusive. `RUNTIME_MONITORING` is preferred as it covers EC2, ECS, and EKS.

Sub-options under `runtime_monitoring`:

| Sub-option                     | Variable                       |
| ------------------------------ | ------------------------------ |
| `EKS_ADDON_MANAGEMENT`         | `eks_addon_management`         |
| `ECS_FARGATE_AGENT_MANAGEMENT` | `ecs_fargate_agent_management` |
| `EC2_AGENT_MANAGEMENT`         | `ec2_agent_management`         |

## Onboarding a new account

1. Add a provider alias in `providers.tf`
2. Add a module block in `members.tf` with the features map
3. Plan and apply

<!-- BEGIN_TF_DOCS — DO NOT EDIT BELOW THIS LINE -->

## Requirements

| Name                                                                     | Version            |
| ------------------------------------------------------------------------ | ------------------ |
| <a name="requirement_terraform"></a> [terraform](#requirement_terraform) | >= 1.15.0, < 2.0.0 |
| <a name="requirement_aws"></a> [aws](#requirement_aws)                   | >= 6.0, < 7.0      |

## Providers

| Name                                                                  | Version       |
| --------------------------------------------------------------------- | ------------- |
| <a name="provider_aws.member"></a> [aws.member](#provider_aws.member) | >= 6.0, < 7.0 |

## Resources

| Name                                                                                                                                          | Type     |
| --------------------------------------------------------------------------------------------------------------------------------------------- | -------- |
| [aws_guardduty_detector_feature.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/guardduty_detector_feature) | resource |

## Inputs

| Name                                                      | Description                                            | Type                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | Default | Required |
| --------------------------------------------------------- | ------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- | :------: |
| <a name="input_features"></a> [features](#input_features) | GuardDuty feature configuration for the member account | <pre>object({<br/> s3_data_events = optional(bool, false)<br/> eks_audit_logs = optional(bool, false)<br/> ebs_malware_protection = optional(bool, false)<br/> rds_login_events = optional(bool, false)<br/> lambda_network_logs = optional(bool, false)<br/> eks_runtime_monitoring = optional(bool, false)<br/> ai_protection = optional(bool, false)<br/> ai_analyst = optional(bool, false)<br/> runtime_monitoring = optional(object({<br/> enabled = optional(bool, false)<br/> eks_addon_management = optional(bool, false)<br/> ecs_fargate_agent_management = optional(bool, false)<br/> ec2_agent_management = optional(bool, false)<br/> }), {})<br/> })</pre> | `{}`    |    no    |

## Outputs

| Name                                                                                | Description                                                    |
| ----------------------------------------------------------------------------------- | -------------------------------------------------------------- |
| <a name="output_detector_id"></a> [detector_id](#output_detector_id)                | GuardDuty detector ID of the member account                    |
| <a name="output_enabled_features"></a> [enabled_features](#output_enabled_features) | Features and their configuration enabled on the member account |

<!-- END_TF_DOCS — DO NOT EDIT ABOVE THIS LINE -->