guardduty-member

Configures GuardDuty protection features on a member account detector. Designed to be called once per member account, passing a provider alias that assumes a role in the target account.

Prerequisites

• GuardDuty must already be enabled on the member account (via org auto-enroll or manually)
• A Terraform execution role must exist in the member account that the calling stack can assume
• The guardduty module must already be applied in the admin account

Usage

provider "aws" {
  alias  = "hca_prod"
  region = var.aws_region

  assume_role {
    role_arn = "arn:aws:iam::<account-id>:role/hca-iac-execution-role"
  }
}

module "guardduty_hca_prod" {
  source = "hcassc.jfrog.io/iac-tf-modules-virtual__governance/guardduty-member/aws"
  version = "1.0.0"

  providers = {
    aws.member = aws.hca_prod
  }

  features = {
    s3_data_events         = true
    eks_audit_logs         = true
    ebs_malware_protection = true
    rds_login_events       = false
    lambda_network_logs    = false
    eks_runtime_monitoring = false
    ai_protection          = false
    ai_analyst             = false
    runtime_monitoring = {
      enabled                      = true
      eks_addon_management         = false
      ecs_fargate_agent_management = false
      ec2_agent_management         = false
    }
  }
}

Only specify the features you want to manage. All default to false.

Features

Feature	Variable	Notes
S3_DATA_EVENTS	s3_data_events
EKS_AUDIT_LOGS	eks_audit_logs
EBS_MALWARE_PROTECTION	ebs_malware_protection
RDS_LOGIN_EVENTS	rds_login_events
LAMBDA_NETWORK_LOGS	lambda_network_logs
AI_PROTECTION	ai_protection
AI_ANALYST	ai_analyst
RUNTIME_MONITORING	runtime_monitoring.enabled	Mutually exclusive with EKS_RUNTIME_MONITORING
EKS_RUNTIME_MONITORING	eks_runtime_monitoring	Mutually exclusive with RUNTIME_MONITORING

Runtime monitoring

RUNTIME_MONITORING and EKS_RUNTIME_MONITORING are mutually exclusive. RUNTIME_MONITORING is preferred as it covers EC2, ECS, and EKS.

Sub-options under runtime_monitoring:

Sub-option	Variable
EKS_ADDON_MANAGEMENT	eks_addon_management
ECS_FARGATE_AGENT_MANAGEMENT	ecs_fargate_agent_management
EC2_AGENT_MANAGEMENT	ec2_agent_management

Onboarding a new account

1. Add a provider alias in providers.tf
2. Add a module block in members.tf with the features map
3. Plan and apply

Requirements

Name	Version
terraform	>= 1.15.0, < 2.0.0
aws	>= 6.0, < 7.0

Providers

Name	Version
aws.member	>= 6.0, < 7.0

Resources

Name	Type
aws_guardduty_detector_feature.this	resource

Inputs

Name	Description	Type	Default	Required
features	GuardDuty feature configuration for the member account	object({ s3_data_events = optional(bool, false) eks_audit_logs = optional(bool, false) ebs_malware_protection = optional(bool, false) rds_login_events = optional(bool, false) lambda_network_logs = optional(bool, false) eks_runtime_monitoring = optional(bool, false) ai_protection = optional(bool, false) ai_analyst = optional(bool, false) runtime_monitoring = optional(object({ enabled = optional(bool, false) eks_addon_management = optional(bool, false) ecs_fargate_agent_management = optional(bool, false) ec2_agent_management = optional(bool, false) }), {}) })	{}	no

Outputs

Name	Description
detector_id	GuardDuty detector ID of the member account
enabled_features	Features and their configuration enabled on the member account