GuardDuty detector is managed by an administrator account or is the administrator with member accounts
guardduty_centrally_managed
Amazon GuardDuty detectors are under centralized management when linked to a delegated administrator account, or when the detector's account serves as the administrator with associated member accounts.
Risk
Lack of central management fragments visibility and slows incident response across accounts and regions. Adversaries can persist unnoticed, perform lateral movement, exfiltrate data, and alter configurations, harming confidentiality, integrity, and availability.
prowler aws --checks guardduty_centrally_managed
Recommendation
Designate a delegated administrator (preferably via AWS Organizations) and enroll all accounts as members. Enable auto-enrollment for new accounts, standardize detector settings across required regions, and route findings to central monitoring. Apply least privilege and separation of duties.
Remediation
aws guardduty enable-organization-admin-account --admin-account-id <ADMIN_ACCOUNT_ID>
- Sign in to the AWS Organizations management account
- Open the AWS Organizations console
- Go to Services > Amazon GuardDuty
- Click Register delegated administrator
- Enter the admin account ID and click Register
Source Code
Resource Type
AwsGuardDutyDetector