pulumi-aws-kotlin/com.pulumi.aws.guardduty.kotlin/DetectorArgs

DetectorArgs

data class DetectorArgs(val datasources: Output<DetectorDatasourcesArgs>? = null, val enable: Output<Boolean>? = null, val findingPublishingFrequency: Output<String>? = null, val tags: Output<Map<String, String>>? = null) : ConvertibleToJava<DetectorArgs>

Provides a resource to manage an Amazon GuardDuty detector.

NOTE: Deleting this resource is equivalent to "disabling" GuardDuty for an AWS region, which removes all existing findings. You can set the enable attribute to false to instead "suspend" monitoring and feedback reporting while keeping existing data. See the Suspending or Disabling Amazon GuardDuty documentation for more information.

Example Usage

import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";
const myDetector = new aws.guardduty.Detector("MyDetector", {
    enable: true,
    datasources: {
        s3Logs: {
            enable: true,
        },
        kubernetes: {
            auditLogs: {
                enable: false,
            },
        },
        malwareProtection: {
            scanEc2InstanceWithFindings: {
                ebsVolumes: {
                    enable: true,
                },
            },
        },
    },
});

import pulumi
import pulumi_aws as aws
my_detector = aws.guardduty.Detector("MyDetector",
    enable=True,
    datasources={
        "s3_logs": {
            "enable": True,
        },
        "kubernetes": {
            "audit_logs": {
                "enable": False,
            },
        },
        "malware_protection": {
            "scan_ec2_instance_with_findings": {
                "ebs_volumes": {
                    "enable": True,
                },
            },
        },
    })

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Aws = Pulumi.Aws;
return await Deployment.RunAsync(() =>
{
    var myDetector = new Aws.GuardDuty.Detector("MyDetector", new()
    {
        Enable = true,
        Datasources = new Aws.GuardDuty.Inputs.DetectorDatasourcesArgs
        {
            S3Logs = new Aws.GuardDuty.Inputs.DetectorDatasourcesS3LogsArgs
            {
                Enable = true,
            },
            Kubernetes = new Aws.GuardDuty.Inputs.DetectorDatasourcesKubernetesArgs
            {
                AuditLogs = new Aws.GuardDuty.Inputs.DetectorDatasourcesKubernetesAuditLogsArgs
                {
                    Enable = false,
                },
            },
            MalwareProtection = new Aws.GuardDuty.Inputs.DetectorDatasourcesMalwareProtectionArgs
            {
                ScanEc2InstanceWithFindings = new Aws.GuardDuty.Inputs.DetectorDatasourcesMalwareProtectionScanEc2InstanceWithFindingsArgs
                {
                    EbsVolumes = new Aws.GuardDuty.Inputs.DetectorDatasourcesMalwareProtectionScanEc2InstanceWithFindingsEbsVolumesArgs
                    {
                        Enable = true,
                    },
                },
            },
        },
    });
});

package main
import (
	"github.com/pulumi/pulumi-aws/sdk/v6/go/aws/guardduty"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := guardduty.NewDetector(ctx, "MyDetector", &guardduty.DetectorArgs{
			Enable: pulumi.Bool(true),
			Datasources: &guardduty.DetectorDatasourcesArgs{
				S3Logs: &guardduty.DetectorDatasourcesS3LogsArgs{
					Enable: pulumi.Bool(true),
				},
				Kubernetes: &guardduty.DetectorDatasourcesKubernetesArgs{
					AuditLogs: &guardduty.DetectorDatasourcesKubernetesAuditLogsArgs{
						Enable: pulumi.Bool(false),
					},
				},
				MalwareProtection: &guardduty.DetectorDatasourcesMalwareProtectionArgs{
					ScanEc2InstanceWithFindings: &guardduty.DetectorDatasourcesMalwareProtectionScanEc2InstanceWithFindingsArgs{
						EbsVolumes: &guardduty.DetectorDatasourcesMalwareProtectionScanEc2InstanceWithFindingsEbsVolumesArgs{
							Enable: pulumi.Bool(true),
						},
					},
				},
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.guardduty.Detector;
import com.pulumi.aws.guardduty.DetectorArgs;
import com.pulumi.aws.guardduty.inputs.DetectorDatasourcesArgs;
import com.pulumi.aws.guardduty.inputs.DetectorDatasourcesS3LogsArgs;
import com.pulumi.aws.guardduty.inputs.DetectorDatasourcesKubernetesArgs;
import com.pulumi.aws.guardduty.inputs.DetectorDatasourcesKubernetesAuditLogsArgs;
import com.pulumi.aws.guardduty.inputs.DetectorDatasourcesMalwareProtectionArgs;
import com.pulumi.aws.guardduty.inputs.DetectorDatasourcesMalwareProtectionScanEc2InstanceWithFindingsArgs;
import com.pulumi.aws.guardduty.inputs.DetectorDatasourcesMalwareProtectionScanEc2InstanceWithFindingsEbsVolumesArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }
    public static void stack(Context ctx) {
        var myDetector = new Detector("myDetector", DetectorArgs.builder()
            .enable(true)
            .datasources(DetectorDatasourcesArgs.builder()
                .s3Logs(DetectorDatasourcesS3LogsArgs.builder()
                    .enable(true)
                    .build())
                .kubernetes(DetectorDatasourcesKubernetesArgs.builder()
                    .auditLogs(DetectorDatasourcesKubernetesAuditLogsArgs.builder()
                        .enable(false)
                        .build())
                    .build())
                .malwareProtection(DetectorDatasourcesMalwareProtectionArgs.builder()
                    .scanEc2InstanceWithFindings(DetectorDatasourcesMalwareProtectionScanEc2InstanceWithFindingsArgs.builder()
                        .ebsVolumes(DetectorDatasourcesMalwareProtectionScanEc2InstanceWithFindingsEbsVolumesArgs.builder()
                            .enable(true)
                            .build())
                        .build())
                    .build())
                .build())
            .build());
    }
}

resources:
  myDetector:
    type: aws:guardduty:Detector
    name: MyDetector
    properties:
      enable: true
      datasources:
        s3Logs:
          enable: true
        kubernetes:
          auditLogs:
            enable: false
        malwareProtection:
          scanEc2InstanceWithFindings:
            ebsVolumes:
              enable: true

Import

Using pulumi import, import GuardDuty detectors using the detector ID. For example:

$ pulumi import aws:guardduty/detector:Detector MyDetector 00b00fd5aecc0ab60a708659477e9617

The ID of the detector can be retrieved via the AWS CLI using aws guardduty list-detectors.

Constructors

DetectorArgs

constructor(datasources: Output<DetectorDatasourcesArgs>? = null, enable: Output<Boolean>? = null, findingPublishingFrequency: Output<String>? = null, tags: Output<Map<String, String>>? = null)

Properties

datasources

val datasources: Output<DetectorDatasourcesArgs>? = null

Describes which data sources will be enabled for the detector. See Data Sources below for more details. Deprecated in favor of aws.guardduty.DetectorFeature resources.

enable

val enable: Output<Boolean>? = null

Enable monitoring and feedback reporting. Setting to false is equivalent to "suspending" GuardDuty. Defaults to true.

findingPublishingFrequency

val findingPublishingFrequency: Output<String>? = null

Specifies the frequency of notifications sent for subsequent finding occurrences. If the detector is a GuardDuty member account, the value is determined by the GuardDuty primary account and cannot be modified, otherwise defaults to SIX_HOURS. For standalone and GuardDuty primary accounts, it must be configured in this provider to enable drift detection. Valid values for standalone and primary accounts: FIFTEEN_MINUTES, ONE_HOUR, SIX_HOURS. See AWS Documentation for more information.

Functions

toJava

open override fun toJava(): DetectorArgs