Detector
Provides a resource to manage a GuardDuty detector.
NOTE: Deleting this resource is equivalent to "disabling" GuardDuty for an AWS region, which removes all existing findings. You can set the
enableattribute tofalseto instead "suspend" monitoring and feedback reporting while keeping existing data. See the Suspending or Disabling Amazon GuardDuty documentation for more information.
Example Usage
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.guardduty.Detector;
import com.pulumi.aws.guardduty.DetectorArgs;
import com.pulumi.aws.guardduty.inputs.DetectorDatasourcesArgs;
import com.pulumi.aws.guardduty.inputs.DetectorDatasourcesKubernetesArgs;
import com.pulumi.aws.guardduty.inputs.DetectorDatasourcesKubernetesAuditLogsArgs;
import com.pulumi.aws.guardduty.inputs.DetectorDatasourcesMalwareProtectionArgs;
import com.pulumi.aws.guardduty.inputs.DetectorDatasourcesMalwareProtectionScanEc2InstanceWithFindingsArgs;
import com.pulumi.aws.guardduty.inputs.DetectorDatasourcesMalwareProtectionScanEc2InstanceWithFindingsEbsVolumesArgs;
import com.pulumi.aws.guardduty.inputs.DetectorDatasourcesS3LogsArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var myDetector = new Detector("myDetector", DetectorArgs.builder()
.datasources(DetectorDatasourcesArgs.builder()
.kubernetes(DetectorDatasourcesKubernetesArgs.builder()
.auditLogs(DetectorDatasourcesKubernetesAuditLogsArgs.builder()
.enable(false)
.build())
.build())
.malwareProtection(DetectorDatasourcesMalwareProtectionArgs.builder()
.scanEc2InstanceWithFindings(DetectorDatasourcesMalwareProtectionScanEc2InstanceWithFindingsArgs.builder()
.ebsVolumes(DetectorDatasourcesMalwareProtectionScanEc2InstanceWithFindingsEbsVolumesArgs.builder()
.enable(true)
.build())
.build())
.build())
.s3Logs(DetectorDatasourcesS3LogsArgs.builder()
.enable(true)
.build())
.build())
.enable(true)
.build());
}
}Import
GuardDuty detectors can be imported using the detector ID, e.g.,
$ pulumi import aws:guardduty/detector:Detector MyDetector 00b00fd5aecc0ab60a708659477e9617The ID of the detector can be retrieved via the AWS CLI using aws guardduty list-detectors.
Properties
Describes which data sources will be enabled for the detector. See Data Sources below for more details.
Specifies the frequency of notifications sent for subsequent finding occurrences. If the detector is a GuardDuty member account, the value is determined by the GuardDuty primary account and cannot be modified, otherwise defaults to SIX_HOURS. For standalone and GuardDuty primary accounts, it must be configured in this provider to enable drift detection. Valid values for standalone and primary accounts: FIFTEEN_MINUTES, ONE_HOUR, SIX_HOURS. See AWS Documentation for more information.