GuardDuty has delegated admin configured and is enabled in all regions with organization auto-enable
guardduty_delegated_admin_enabled_all_regions
Amazon GuardDuty has a delegated administrator configured at the organization level, detectors are enabled in all opted-in regions, and organization auto-enable is active for new member accounts.
Risk
Without org-wide Amazon GuardDuty configuration, gaps can occur where detectors are enabled in some regions but not others, delegated admin is inconsistent, and new accounts are not auto-enrolled. This fragments threat visibility, delays incident response, and allows adversaries to exploit unmonitored regions or accounts for lateral movement and data exfiltration.
prowler aws --checks guardduty_delegated_admin_enabled_all_regions
Recommendation
Configure a delegated administrator for GuardDuty via AWS Organizations. Enable GuardDuty detectors in all opted-in regions and configure auto-enable to automatically enroll new member accounts. This ensures consistent threat detection coverage across the entire organization.
Remediation
aws guardduty enable-organization-admin-account --admin-account-id <ADMIN_ACCOUNT_ID> && aws guardduty update-organization-configuration --detector-id <DETECTOR_ID> --auto-enable-organization-members ALL
- Sign in to the AWS Organizations management account
- Open the AWS Organizations console
- Navigate to Services > Amazon GuardDuty
- Click Register delegated administrator and enter the security account ID
- Switch to the delegated admin account
- In GuardDuty console, go to Settings > Accounts
- Enable auto-enable for all organization members
- Repeat detector enablement for all opted-in regions
Source Code
Resource Type
AwsGuardDutyDetector
References
Related To
- guardduty_is_enabled
- guardduty_centrally_managed