Skip to main content

⭐ Repository → 📁 Compliance Engine → 📁 CloudAware → 📁 AWS → 📁 GuardDuty

🛡️ AWS GuardDuty is not enabled in all regions🟢

Logic​

Similar Policies​

Description​

Open File

Description​

This policy identifies whether AWS GuardDuty is enabled in all active AWS regions for an account.

AWS GuardDuty is a threat detection service that continuously monitors AWS accounts and workloads for malicious or unauthorized activity, providing detailed security findings to support timely remediation.

Rationale​

Enabling GuardDuty in all regions is a security best practice. Adversaries may exploit unused or unmonitored regions to launch resources or conduct malicious activities undetected. Enabling GuardDuty across all regions ensures comprehensive visibility and consistent threat detection, reducing the risk of security blind spots.

Impact​

If GuardDuty is not enabled in all regions, critical security findings—such as indicators of unauthorized access, compromised instances, or reconnaissance attempts, may be missed in unmonitored regions. This can delay incident response and increase the impact of potential breaches.

Enabling GuardDuty in all regions incurs costs based on the volume of AWS CloudTrail events, VPC Flow Logs, and DNS query logs analyzed.

... see more

Remediation​

Open File

Remediation​

Enable GuardDuty in a Region​

From Command Line​

  1. o enable GuardDuty in a specific region, run the following command, replacing {{region}} with the target region:

    aws guardduty create-detector --enable --region {{region}}

  2. To enable GuardDuty in all available AWS regions, you can use the following shell script:

    #!/bin/bash
    for region in $(aws ec2 describe-regions --query "Regions[].RegionName" --output text); do
    echo "Checking GuardDuty in region: $region"

    DETECTOR_ID=$(aws guardduty list-detectors --region $region --query "DetectorIds[0]" --output text)

    if [ "$DETECTOR_ID" == "None" ] || [ -z "$DETECTOR_ID" ]; then
        echo "GuardDuty not found in $region. Enabling..."
        aws guardduty create-detector --enable --region $region

        if [ $? -eq 0 ]; then
        echo "Successfully enabled GuardDuty in $region."
        else
        echo "Failed to enable GuardDuty in $region."
        fi
    else
        echo "GuardDuty is already enabled in $region with Detector ID: $DETECTOR_ID"

... see more

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [GuardDuty.1] GuardDuty should be enabled1no data
💼 AWS Well-Architected → 💼 SEC04-BP03 Correlate and enrich security alerts1no data
💼 AWS Well-Architected → 💼 SEC04-BP04 Initiate remediation for non-compliant resources1no data
💼 AWS Well-Architected → 💼 SEC05-BP03 Implement inspection-based protection1no data
💼 AWS Well-Architected → 💼 SEC05-BP04 Automate network protection1no data
💼 Cloudaware Framework → 💼 Threat Protection29no data
💼 FedRAMP High Security Controls → 💼 AC-2(12) Account Monitoring for Atypical Usage (M)(H)12no data
💼 FedRAMP High Security Controls → 💼 AU-6(1) Automated Process Integration (M)(H)3no data
💼 FedRAMP High Security Controls → 💼 AU-6(5) Integrated Analysis of Audit Records (H)2no data
💼 FedRAMP High Security Controls → 💼 CA-7 Continuous Monitoring (L)(M)(H)212no data
💼 FedRAMP High Security Controls → 💼 CM-8(3) Automated Unauthorized Component Detection (M)(H)1no data
💼 FedRAMP High Security Controls → 💼 SA-11(1) Static Code Analysis (M)(H)1no data
💼 FedRAMP High Security Controls → 💼 SC-5 Denial-of-service Protection (L)(M)(H)1no data
💼 FedRAMP High Security Controls → 💼 SI-4 System Monitoring (L)(M)(H)145056no data
💼 FedRAMP High Security Controls → 💼 SI-4(1) System-wide Intrusion Detection System (M)(H)12no data
💼 FedRAMP High Security Controls → 💼 SI-4(2) Automated Tools and Mechanisms for Real-time Analysis (M)(H)1no data
💼 FedRAMP High Security Controls → 💼 SI-4(4) Inbound and Outbound Communications Traffic (M)(H)68no data
💼 FedRAMP High Security Controls → 💼 SI-4(5) System-generated Alerts (M)(H)1no data
💼 FedRAMP High Security Controls → 💼 SI-4(22) Unauthorized Network Services (H)1no data
💼 FedRAMP Low Security Controls → 💼 CA-7 Continuous Monitoring (L)(M)(H)112no data
💼 FedRAMP Low Security Controls → 💼 SC-5 Denial-of-service Protection (L)(M)(H)1no data
💼 FedRAMP Low Security Controls → 💼 SI-4 System Monitoring (L)(M)(H)8no data
💼 FedRAMP Moderate Security Controls → 💼 AC-2(12) Account Monitoring for Atypical Usage (M)(H)2no data
💼 FedRAMP Moderate Security Controls → 💼 AU-6(1) Automated Process Integration (M)(H)3no data
💼 FedRAMP Moderate Security Controls → 💼 CA-7 Continuous Monitoring (L)(M)(H)212no data
💼 FedRAMP Moderate Security Controls → 💼 CM-8(3) Automated Unauthorized Component Detection (M)(H)1no data
💼 FedRAMP Moderate Security Controls → 💼 SA-11(1) Static Code Analysis (M)(H)1no data
💼 FedRAMP Moderate Security Controls → 💼 SC-5 Denial-of-service Protection (L)(M)(H)1no data
💼 FedRAMP Moderate Security Controls → 💼 SI-4 System Monitoring (L)(M)(H)79no data
💼 FedRAMP Moderate Security Controls → 💼 SI-4(1) System-wide Intrusion Detection System (M)(H)2no data
💼 FedRAMP Moderate Security Controls → 💼 SI-4(2) Automated Tools and Mechanisms for Real-time Analysis (M)(H)1no data
💼 FedRAMP Moderate Security Controls → 💼 SI-4(4) Inbound and Outbound Communications Traffic (M)(H)8no data
💼 FedRAMP Moderate Security Controls → 💼 SI-4(5) System-generated Alerts (M)(H)1no data
💼 NIST CSF v2.0 → 💼 DE.AE-02: Potentially adverse events are analyzed to better understand associated activities33no data
💼 NIST CSF v2.0 → 💼 DE.AE-03: Information is correlated from multiple sources48no data
💼 NIST CSF v2.0 → 💼 DE.CM-01: Networks and network services are monitored to find potentially adverse events120no data
💼 NIST CSF v2.0 → 💼 DE.CM-02: The physical environment is monitored to find potentially adverse events12no data
💼 NIST CSF v2.0 → 💼 DE.CM-03: Personnel activity and technology usage are monitored to find potentially adverse events83no data
💼 NIST CSF v2.0 → 💼 DE.CM-06: External service provider activities and services are monitored to find potentially adverse events33no data
💼 NIST CSF v2.0 → 💼 DE.CM-09: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events139no data
💼 NIST CSF v2.0 → 💼 ID.IM-01: Improvements are identified from evaluations24no data
💼 NIST CSF v2.0 → 💼 ID.IM-02: Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties37no data
💼 NIST CSF v2.0 → 💼 ID.IM-03: Improvements are identified from execution of operational processes, procedures, and activities38no data
💼 NIST CSF v2.0 → 💼 ID.RA-01: Vulnerabilities in assets are identified, validated, and recorded29no data
💼 NIST CSF v2.0 → 💼 ID.RA-07: Changes and exceptions are managed, assessed for risk impact, recorded, and tracked30no data
💼 NIST CSF v2.0 → 💼 PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected118no data
💼 NIST CSF v2.0 → 💼 PR.DS-02: The confidentiality, integrity, and availability of data-in-transit are protected98no data
💼 NIST CSF v2.0 → 💼 PR.DS-10: The confidentiality, integrity, and availability of data-in-use are protected112no data
💼 NIST CSF v2.0 → 💼 PR.IR-01: Networks and environments are protected from unauthorized logical access and usage70no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-2(12) Account Management _ Account Monitoring for Atypical Usage1no data
💼 NIST SP 800-53 Revision 5 → 💼 AU-6(1) Audit Record Review, Analysis, and Reporting _ Automated Process Integration13no data
💼 NIST SP 800-53 Revision 5 → 💼 AU-6(5) Audit Record Review, Analysis, and Reporting _ Integrated Analysis of Audit Records2no data
💼 NIST SP 800-53 Revision 5 → 💼 CA-7 Continuous Monitoring612no data
💼 NIST SP 800-53 Revision 5 → 💼 CM-8(3) System Component Inventory _ Automated Unauthorized Component Detection1no data
💼 NIST SP 800-53 Revision 5 → 💼 RA-3(4) Risk Assessment _ Predictive Cyber Analytics1no data
💼 NIST SP 800-53 Revision 5 → 💼 SA-8(19) Security and Privacy Engineering Principles _ Continuous Protection1no data
💼 NIST SP 800-53 Revision 5 → 💼 SA-8(21) Security and Privacy Engineering Principles _ Self-analysis1no data
💼 NIST SP 800-53 Revision 5 → 💼 SA-8(25) Security and Privacy Engineering Principles _ Economic Security1no data
💼 NIST SP 800-53 Revision 5 → 💼 SA-11(1) Developer Testing and Evaluation _ Static Code Analysis1no data
💼 NIST SP 800-53 Revision 5 → 💼 SA-11(6) Developer Testing and Evaluation _ Attack Surface Reviews1no data
💼 NIST SP 800-53 Revision 5 → 💼 SA-15(2) Development Process, Standards, and Tools _ Security and Privacy Tracking Tools1no data
💼 NIST SP 800-53 Revision 5 → 💼 SA-15(8) Development Process, Standards, and Tools _ Reuse of Threat and Vulnerability Information1no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-5 Denial-of-service Protection36no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-5(1) Denial-of-service Protection _ Restrict Ability to Attack Other Systems1no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-5(3) Denial-of-service Protection _ Detection and Monitoring1no data
💼 NIST SP 800-53 Revision 5 → 💼 SI-3(8) Malicious Code Protection _ Detect Unauthorized Commands6no data
💼 NIST SP 800-53 Revision 5 → 💼 SI-4 System Monitoring25110no data
💼 NIST SP 800-53 Revision 5 → 💼 SI-4(1) System Monitoring _ System-wide Intrusion Detection System1no data
💼 NIST SP 800-53 Revision 5 → 💼 SI-4(2) System Monitoring _ Automated Tools and Mechanisms for Real-time Analysis1no data
💼 NIST SP 800-53 Revision 5 → 💼 SI-4(4) System Monitoring _ Inbound and Outbound Communications Traffic12no data
💼 NIST SP 800-53 Revision 5 → 💼 SI-4(5) System Monitoring _ System-generated Alerts1no data
💼 NIST SP 800-53 Revision 5 → 💼 SI-4(13) System Monitoring _ Analyze Traffic and Event Patterns1no data
💼 NIST SP 800-53 Revision 5 → 💼 SI-4(22) System Monitoring _ Unauthorized Network Services1no data
💼 NIST SP 800-53 Revision 5 → 💼 SI-4(25) System Monitoring _ Optimize Network Traffic Analysis1no data
💼 NIST SP 800-53 Revision 5 → 💼 SI-20 Tainting1no data
💼 PCI DSS v3.2.1 → 💼 11.1.2 Implement incident response procedures in the event unauthorized wireless access points are detected.1no data
💼 PCI DSS v3.2.1 → 💼 11.4 Use intrusion-detection and/or intrusion-prevention techniques to detect and/or prevent intrusions into the network.19no data
💼 PCI DSS v3.2.1 → 💼 11.5.1 Implement a process to respond to any alerts generated by the change detection solution.1no data
💼 PCI DSS v3.2.1 → 💼 12.10.5 Include alerts from security monitoring systems, including but not limited to intrusion-detection, intrusion-prevention, firewalls, and file-integrity monitoring systems.1no data
💼 PCI DSS v4.0.1 → 💼 11.5.1 Intrusion-detection and/or intrusion-prevention techniques are used to detect and/or prevent intrusions into the network.19no data
💼 PCI DSS v4.0.1 → 💼 11.5.1.1 Intrusion-detection and/or intrusion-prevention techniques detect, alert on/prevent, and address covert malware communication channels.9no data
💼 PCI DSS v4.0.1 → 💼 11.6.1 A change- and tamper-detection mechanism is deployed.9no data
💼 PCI DSS v4.0.1 → 💼 12.10.5 The security incident response plan includes monitoring and responding to alerts from security monitoring systems.1no data
💼 PCI DSS v4.0 → 💼 11.5.1 Intrusion-detection and/or intrusion-prevention techniques are used to detect and/or prevent intrusions into the network.189no data
💼 PCI DSS v4.0 → 💼 11.5.1.1 Intrusion-detection and/or intrusion-prevention techniques detect, alert on/prevent, and address covert malware communication channels.89no data
💼 PCI DSS v4.0 → 💼 11.6.1 A change- and tamper-detection mechanism is deployed.9no data
💼 PCI DSS v4.0 → 💼 12.10.5 The security incident response plan includes monitoring and responding to alerts from security monitoring systems.1no data