guardduty-member

Configures GuardDuty protection features on a member account detector. Designed to be called once per member account, passing a provider alias that assumes a role in the target account.

Prerequisites

GuardDuty must already be enabled on the member account (via org auto-enroll or manually)
A Terraform execution role must exist in the member account that the calling stack can assume
The guardduty module must already be applied in the admin account

Usage

provider "aws" {
  alias  = "hca_prod"
  region = var.aws_region

  assume_role {
    role_arn = "arn:aws:iam::<account-id>:role/hca-iac-execution-role"
  }
}

module "guardduty_hca_prod" {
  source = "hcassc.jfrog.io/iac-tf-modules-virtual__governance/guardduty-member/aws"
  version = "1.0.0"

  providers = {
    aws.member = aws.hca_prod
  }

  features = {
    s3_data_events         = true
    eks_audit_logs         = true
    ebs_malware_protection = true
    rds_login_events       = false
    lambda_network_logs    = false
    eks_runtime_monitoring = false
    ai_protection          = false
    ai_analyst             = false
    runtime_monitoring = {
      enabled                      = true
      eks_addon_management         = false
      ecs_fargate_agent_management = false
      ec2_agent_management         = false
    }
  }
}

Only specify the features you want to manage. All default to false.

Features

Feature	Variable	Notes
`S3_DATA_EVENTS`	`s3_data_events`
`EKS_AUDIT_LOGS`	`eks_audit_logs`
`EBS_MALWARE_PROTECTION`	`ebs_malware_protection`
`RDS_LOGIN_EVENTS`	`rds_login_events`
`LAMBDA_NETWORK_LOGS`	`lambda_network_logs`
`AI_PROTECTION`	`ai_protection`
`AI_ANALYST`	`ai_analyst`
`RUNTIME_MONITORING`	`runtime_monitoring.enabled`	Mutually exclusive with `EKS_RUNTIME_MONITORING`
`EKS_RUNTIME_MONITORING`	`eks_runtime_monitoring`	Mutually exclusive with `RUNTIME_MONITORING`

Runtime monitoring

RUNTIME_MONITORING and EKS_RUNTIME_MONITORING are mutually exclusive. RUNTIME_MONITORING is preferred as it covers EC2, ECS, and EKS.

Sub-options under runtime_monitoring:

Sub-option	Variable
`EKS_ADDON_MANAGEMENT`	`eks_addon_management`
`ECS_FARGATE_AGENT_MANAGEMENT`	`ecs_fargate_agent_management`
`EC2_AGENT_MANAGEMENT`	`ec2_agent_management`

Onboarding a new account

Add a provider alias in providers.tf
Add a module block in members.tf with the features map
Plan and apply

Requirements

Name	Version
terraform	>= 1.15.0, < 2.0.0
aws	>= 6.0, < 7.0

Providers

Name	Version
aws.member	>= 6.0, < 7.0

Resources

Name	Type
aws_guardduty_detector_feature.this	resource

Inputs

Name	Description	Type	Default	Required
features	GuardDuty feature configuration for the member account	object({ s3_data_events = optional(bool, false) eks_audit_logs = optional(bool, false) ebs_malware_protection = optional(bool, false) rds_login_events = optional(bool, false) lambda_network_logs = optional(bool, false) eks_runtime_monitoring = optional(bool, false) ai_protection = optional(bool, false) ai_analyst = optional(bool, false) runtime_monitoring = optional(object({ enabled = optional(bool, false) eks_addon_management = optional(bool, false) ecs_fargate_agent_management = optional(bool, false) ec2_agent_management = optional(bool, false) }), {}) })	`{}`	no

Outputs

Name	Description
detector_id	GuardDuty detector ID of the member account
enabled_features	Features and their configuration enabled on the member account