GuardDuty detector is managed by an administrator account or is the administrator with member accounts
Amazon GuardDuty detectors are under centralized management when linked to a delegated administrator account, or when the detector's account serves as the administrator with associated member accounts.
ProwlerRisk
Lack of central management fragments visibility and slows incident response across accounts and regions. Adversaries can persist unnoticed, perform lateral movement, exfiltrate data, and alter configurations, harming confidentiality, integrity, and availability.
Run this check with Prowler
Run in Prowler Cloudprowler aws --checks guardduty_centrally_managedRecommendation
Designate a delegated administrator (preferably via AWS Organizations) and enroll all accounts as members. Enable auto-enrollment for new accounts, standardize detector settings across required regions, and route findings to central monitoring. Apply least privilege and separation of duties.
Remediation
CLI
aws guardduty enable-organization-admin-account --admin-account-id <ADMIN_ACCOUNT_ID>Other
Check Code
from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.guardduty.guardduty_client import guardduty_client
class guardduty_centrally_managed(Check):
def execute(self):
findings = []
for detector in guardduty_client.detectors:
if detector.id and detector.enabled_in_account:
report = Check_Report_AWS(metadata=self.metadata(), resource=detector)
report.status = "FAIL"
report.status_extended = (
f"GuardDuty detector {detector.id} is not centrally managed."
)
if detector.administrator_account:
report.status = "PASS"
report.status_extended = f"GuardDuty detector {detector.id} is centrally managed by account {detector.administrator_account}."
elif detector.member_accounts:
report.status = "PASS"
report.status_extended = f"GuardDuty detector {detector.id} is administrator account with {len(detector.member_accounts)} member accounts."
findings.append(report)
return findings