Product logo
DocsBlogPricing

@turbot/aws-guardduty

The aws-guardduty mod contains resource, control and policy definitions for AWS GuardDuty service.

Version
5.7.0
Released On
Oct 09, 2023
Depends On

Resource Types

Control Types

Policy Types

Release Notes

5.7.0 (2023-10-09)

What's new?

  • We've updated the runtime of the lambda functions to Node 18. You wouldn't notice any difference and things will continue to work smoothly and consistently as before.

  • Resource's metadata will now also include createdBy details in Turbot CMDB.

  • Users can now perform quick actions on resources to remediate cloud configuration issues or skip Turbot alarms for issues that they want to come back to later. To get started, click on the Actions button, which will reveal a dropdown menu with available actions, and select one. See Quick Actions for more information.

Action Types

  • AWS > GuardDuty > Detector > Delete from AWS
  • AWS > GuardDuty > Detector > Set Tags
  • AWS > GuardDuty > Detector > Skip alarm for Active control
  • AWS > GuardDuty > Detector > Skip alarm for Active control [90 days]
  • AWS > GuardDuty > Detector > Skip alarm for Approved control
  • AWS > GuardDuty > Detector > Skip alarm for Approved control [90 days]
  • AWS > GuardDuty > Detector > Skip alarm for Tags control
  • AWS > GuardDuty > Detector > Skip alarm for Tags control [90 days]
  • AWS > GuardDuty > IPSet > Delete from AWS
  • AWS > GuardDuty > IPSet > Set Tags
  • AWS > GuardDuty > IPSet > Skip alarm for Active control
  • AWS > GuardDuty > IPSet > Skip alarm for Active control [90 days]
  • AWS > GuardDuty > IPSet > Skip alarm for Approved control
  • AWS > GuardDuty > IPSet > Skip alarm for Approved control [90 days]
  • AWS > GuardDuty > IPSet > Skip alarm for Tags control
  • AWS > GuardDuty > IPSet > Skip alarm for Tags control [90 days]
  • AWS > GuardDuty > ThreatIntelSet > Delete from AWS
  • AWS > GuardDuty > ThreatIntelSet > Set Tags
  • AWS > GuardDuty > ThreatIntelSet > Skip alarm for Active control
  • AWS > GuardDuty > ThreatIntelSet > Skip alarm for Active control [90 days]
  • AWS > GuardDuty > ThreatIntelSet > Skip alarm for Approved control
  • AWS > GuardDuty > ThreatIntelSet > Skip alarm for Approved control [90 days]
  • AWS > GuardDuty > ThreatIntelSet > Skip alarm for Tags control
  • AWS > GuardDuty > ThreatIntelSet > Skip alarm for Tags control [90 days]

5.6.1 (2022-08-04)

Bug fixes

  • The AWS > GuardDuty > Finding > CMDB control would incorrectly move to an error state when the finding was not available in AWS. This is fixed and such resources will now be deleted from Guardrails.

5.6.0 (2022-05-24)

What's new?

  • Users can now create their own custom checks against resource attributes in the Approved control using the Approved > Custom policy. These custom checks would be a part of the evaluation of the Approved control. Custom messages can also be added which are then displayed in the control details table. See Custom Checks for more information.

Bug fixes

  • We've improved the process of deleting resources from Guardrails if their CMDB policy was set to Enforce: Disabled. The CMDB controls will now not look to resolve credentials via Guardrails' IAM role while deleting resources from Guardrails. This will allow the CMDB controls to process resource deletions from Guardrails more reliably than before.

Resource Types

  • AWS > GuardDuty > Finding

Control Types

  • AWS > GuardDuty > Finding > CMDB
  • AWS > GuardDuty > Finding > Discovery

Policy Types

  • AWS > GuardDuty > Detector > Approved > Custom
  • AWS > GuardDuty > Finding > CMDB
  • AWS > GuardDuty > Finding > Regions
  • AWS > GuardDuty > IPSet > Approved > Custom
  • AWS > GuardDuty > ThreatIntelSet > Approved > Custom

Action Types

  • AWS > GuardDuty > Finding > Router

5.5.0 (2021-06-25)

What's new?

  • AWS/GuardDuty/Admin now includes publishing destination permissions.

5.4.1 (2020-09-22)

Bug fixes

  • We've made some improvements to our real-time event handling that reduces the risk of creating resources in CMDB with malformed AKAs. There's no noticeable difference, but things should run more reliably now.

5.4.0 (2020-09-02)

What's new?

  • Discovery controls now have their own control category, CMDB > Discovery, to allow for easier filtering separately from other CMDB controls.
  • We've renamed the service's default regions policy from Regions [Default] to Regions to be consistent with our other regions policies.

5.3.4 (2020-08-12)

Bug fixes

  • In various Active controls, we were outputting log messages that did not properly show how many days were left until we'd delete the inactive resources (we were still deleting them after the correct number of days). These log messages have been fixed and now contain the correct number of days.

5.3.3 (2020-07-23)

Bug fixes

  • AWS/GuardDuty/Admin now includes deleting invitation permissions.

5.3.2 (2020-07-06)

Bug fixes

  • Updated various resource configurations to provide better compatibility with AWS China regions.

5.3.1 (2020-06-15)

What's new?

  • All resource Router actions now run even if Guardrails is outside of its allowed change window. This allows Guardrails to maintain an up-to-date CMDB by handling resource updates at all times. Note that this only affects Guardrails' ability to process resources changes that were made in the cloud provider - enforcement actions are still disabled outside of the change window.

5.3.0 (2020-05-26)

Control Types

  • AWS > GuardDuty > Detector > Configured

Policy Types

  • AWS > GuardDuty > Detector > Configured
  • AWS > GuardDuty > Detector > Configured > Claim Precedence
  • AWS > GuardDuty > Detector > Configured > Source

5.2.0 (2020-05-14)

What's new?

  • Detector CMDB data now contains information on whether the account is a master or member account, along with details of its member accounts if it is a master account.

Bug fixes

  • Removed AWS > GuardDuty > Detector > Configuration, AWS > GuardDuty > IP Set > Configuration, and AWS > GuardDuty > Threat Intel Set > Configuration policies as they were not being used by any controls.

Policy Types

Removed

  • AWS > GuardDuty > Detector > Configuration
  • AWS > GuardDuty > IPSet > Configuration
  • AWS > GuardDuty > ThreatIntelSet > Configuration