Guardduty finding send to cross account's S3 bucket

Question

My requirement is to transfer the Guardduty finding of Account A to the S3 Bucket of Account B
I follow the guide https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_exportfindings.html
but got an error

My steps are:
1. Granting GuardDuty permission to a KMS key，create a key on Account A
2. Granting GuardDuty permissions to a Account B bucket
3. Exporting findings to a bucket with the Console ,The result is the above error
 ![Enter image description here](https://repost.aws/media/postImages/original/IMCQH_3wpxQvOgHqt04VHbhw)

Answer

I believe the gap is in the bucket policy of the S3 bucket in the other account. It needs GetBucketACL  and ListBucket . Try adding that.

Answer

I have set up the cross-account export option following [the Exporting findings documentation](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_exportfindings.html) in my account and I was able to set it up without any issues.

Setup: `Account A: GuardDuty/KMS, Account B: S3 bucket`

Please make sure that you have replaced `region`, `account id`, `kmskeyid`, and `sourceDetectorId` in the sample policies from the documentation. In my setup, I did not use optional prefix so my resource ARN for objects looks like this arn:aws:s3:::/*. Also, make sure that KMS key and S3 bucket are in the same region.

If the issue persists, please share your policies (sanitize account id and resource id).

Guardduty finding send to cross account's S3 bucket

Contenido relevante