enable_guardduty |
Enable monitoring and feedback reporting. Setting to false is equivalent to 'suspending' GuardDuty. Defaults to true . |
bool |
true |
no |
enable_kubernetes_protection |
Configure and enable Kubernetes audit logs as a data source for Kubernetes protection. Defaults to true . |
bool |
true |
no |
enable_malware_protection |
Configure and enable Malware Protection as data source for EC2 instances with findings for the detector. Defaults to true . |
bool |
true |
no |
enable_s3_protection |
Configure and enable S3 protection. Defaults to true . |
bool |
true |
no |
enable_snapshot_retention |
Enable EBS Snaptshot retention for 30 days, if any Findings exists. Defaults to false . |
bool |
false |
no |
filter_config |
Specifies AWS GuardDuty Filter configuration. name - The name of the filter rank - Specifies the position of the filter in the list of current filters. Also specifies the order in which this filter is applied to the findings. action - Specifies the action that is to be applied to the findings that match the filter. Can be one of ARCHIVE or NOOP. criterion - Configuration block for finding_criteria . Composed by field and one or more of the following operators: equals | not_equals | greater_than | greater_than_or_equal | less_than | less_than_or_equal . |
list(object({ name = string description = optional(string) rank = number action = string criterion = list(object({ field = string equals = optional(list(string)) not_equals = optional(list(string)) greater_than = optional(string) greater_than_or_equal = optional(string) less_than = optional(string) less_than_or_equal = optional(string) })) })) |
null |
no |
finding_publishing_frequency |
Specifies the frequency of notifications sent for subsequent finding occurrences. If the detector is a GuardDuty member account, the value is determined by the GuardDuty primary account and cannot be modified. For standalone and GuardDuty primary accounts, it must be configured in Terraform to enable drift detection. Valid values for standalone and primary accounts: FIFTEEN_MINUTES , ONE_HOUR , SIX_HOURS . Defaults to SIX_HOURS . |
string |
"FIFTEEN_MINUTES" |
no |
guardduty_bucket_acl |
Canned ACL to apply to the bucket. Valid values are private | public-read | public-read-write | aws-exec-read | authenticated-read | bucket-owner-read | bucket-owner-full-control . Defaults to null . |
string |
null |
no |
guardduty_s3_bucket |
Name of the S3 Bucket for GuardDuty. Defaults to null . |
string |
null |
no |
ipset_config |
Specifies AWS GuardDuty IPSet configuration. activate - Specifies whether GuardDuty is to start using the uploaded IPSet. name - The friendly name to identify the IPSet. format - The format of the file that contains the IPSet. Valid values: TXT | STIX | OTX_CSV | ALIEN_VAULT | PROOF_POINT | FIRE_EYE . content - Literal string value to use as the object content, which will be uploaded as UTF-8-encoded text. Example: 10.0.0.0/8\n . key - Name of the object once it is in the bucket. |
list(object({ activate = bool name = string format = string content = string key = string })) |
null |
no |
publish_to_s3 |
Specifies if the Amazon GuardDuty findings should be exported to S3. Defaults to false . |
bool |
false |
no |
publishing_config |
Defines the findings publishing configuration. |
list(object({ destination_arn = string kms_key_arn = string destination_type = optional(string) })) |
[ { "destination_arn": null, "destination_type": "S3", "kms_key_arn": null } ] |
no |
replica_region |
Region where S3 bucket data from Amazon GuardDuty will be replicated. Defaults to null . |
string |
null |
no |
tags |
Key-value map of resource tags. If configured with a provider default_tags configuration block present, tags with matching keys will overwrite those defined at the provider-level. Defaults to {} . |
map(any) |
{} |
no |
threatintelset_config |
Specifies AWS GuardDuty ThreatIntelSet configuration. activate - Specifies whether GuardDuty is to start using the uploaded ThreatIntelSet. name - The friendly name to identify the ThreatIntelSet. format - The format of the file that contains the ThreatIntelSet. Valid values: TXT | STIX | OTX_CSV | ALIEN_VAULT | PROOF_POINT | FIRE_EYE . content - Literal string value to use as the object content, which will be uploaded as UTF-8-encoded text. Example: 10.0.0.0/8\n . key - Name of the object once it is in the bucket. object_acl - Canned ACL to apply to the object. Valid values are private | public-read | public-read-write | aws-exec-read | authenticated-read | bucket-owner-read | bucket-owner-full-control . |
list(object({ activate = bool name = string format = string content = string key = string object_acl = string })) |
null |
no |