Export GuardDuty findings to S3 in an AWS Organization

Question

Hi there I am in the process of setting up AWS GuardDuty using [AWS orgs](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_organizations.html) to manage the member accounts. However, I am having trouble setting up the S3 bucket and KMS key for these findings to be sent to.

The GuardDuty org resources are being provisioned in **Account A** which then delegates administrator privileges to **Account B** and is enabling one member in **Account C**. All these accounts are in the same org. 
When provisioning the resources w/ Terraform I get the error: 
```
Error: creating GuardDuty Publishing Destination: operation error GuardDuty: CreatePublishingDestination, https response error StatusCode: 400, RequestID: , BadRequestException: The request failed because the GuardDuty service principal does not have permission to the KMS key or the resource specified by the destinationArn parameter.
```

Here is what I'm using for the S3 bucket policy (replacing sensitive details):

```
{
        "Version": "2012-10-17",
        "Statement": [
          {
            "Sid": "Allow cross account bucket access",
            "Effect": "Allow",
            "Principal": {
              "Service": "guardduty.amazonaws.com"
            },
            "Action": ["s3:GetBucketLocation", "s3:GetBucketAcl", "s3:ListBucket"],
            "Resource": "arn:aws:s3:::",
            "Condition": {
              "ArnLike": {
                "aws:SourceArn": "arn:aws:guardduty:*:*:detector/*"
              },
              "StringEquals": {
                "aws:PrincipalOrgID": ""
              }
            }
          },
          {
            "Sid": "Allow PutObject",
            "Effect": "Allow",
            "Principal": {
              "Service": "guardduty.amazonaws.com"
            },
            "Action": "s3:PutObject",
            "Resource": "arn:aws:s3:::/*",
            "Condition": {
              "ArnLike": {
                "aws:SourceArn": "arn:aws:guardduty:*:*:detector/*"
              },
              "StringEquals": {
                "aws:PrincipalOrgID": ""
              }
            }
          },
...
```
I did not include the encryption related portions of the policy. This was [based off of this doc](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_exportfindings.html).

The relevant portions of the KMS policy (excluding the base permissions for admin access) look like:

```
        {
        "Sid": "AllowGuardDutyKey",
        "Effect": "Allow",
        "Principal": {
            "Service": "guardduty.amazonaws.com"
        },
        "Action": "kms:GenerateDataKey",
        "Resource": "*",
        "Condition": {
            "ArnLike": {
            "aws:SourceArn": "arn:aws:guardduty:*:*:detector/*"	
            },
            "StringEquals": {
            "aws:PrincipalOrgID": ""
            }
        }
        }
    ]
    }
```

What else am I missing here in terms of access policies to enable cross-org access to this bucket & key w/ guardduty?

re:Post Agent · Answer

To successfully export GuardDuty findings to an S3 bucket in an AWS Organization setup, there are a few key points to consider and adjust in your configuration:

1. Ensure that the S3 bucket and KMS key are in the same region as the GuardDuty detector you're configuring for export.

2. The KMS key policy needs to grant GuardDuty permission to use the key for encryption. Your current policy only allows the GenerateDataKey action, which may not be sufficient. Add the following actions to the KMS key policy:

"kms:Encrypt",
   "kms:Decrypt",
   "kms:ReEncrypt*",
   "kms:GenerateDataKey*",
   "kms:DescribeKey"

3. In the S3 bucket policy, make sure you're granting permissions to the GuardDuty service principal from all relevant AWS regions. You can do this by using a wildcard in the Principal section:

"Principal": {
     "Service": "guardduty.*.amazonaws.com"
   }

4. When setting up the publishing destination, ensure you're using the correct ARNs for both the S3 bucket and the KMS key. These should be from Account B (the delegated administrator account) if that's where you've created these resources.

5. If you're setting up the publishing destination from Account A (the organization's management account), make sure it has the necessary permissions to access the S3 bucket and KMS key in Account B. You might need to add cross-account permissions to both the S3 bucket and KMS key policies.

6. Double-check that the org ID used in the condition statements of both policies is correct and matches your AWS Organization ID.

7. Ensure that the GuardDuty service-linked role has been created in all relevant accounts. This role is usually created automatically when GuardDuty is enabled, but it's worth verifying.

If you've implemented these changes and are still encountering issues, you may need to review the IAM permissions of the entity (user or role) that's attempting to create the publishing destination. Ensure it has the necessary permissions to perform this action across accounts in your organization.

Remember, when working with cross-account setups, it can sometimes take a few minutes for permission changes to propagate. If you've made changes, wait a short while and try the operation again.  
**Sources**  
[Exporting generated GuardDuty findings to Amazon S3 buckets - Amazon GuardDuty](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_exportfindings.html)  
[Exporting findings to Amazon S3 - access error - Amazon GuardDuty](https://docs.aws.amazon.com/guardduty/latest/ug/troubleshooting-guardduty-general-issues.html)  
[How to Integrate Amazon GuardDuty Findings with On-Premises Splunk | AWS re:Post](https://repost.aws/articles/ARhXA6njHGRzKEXQ20BKO4lA/how-to-integrate-amazon-guardduty-findings-with-on-premises-splunk)  
[Code repository for AWS SRA examples - AWS Prescriptive Guidance](https://docs.aws.amazon.com/prescriptive-guidance/latest/security-reference-architecture/code-repo.html)

Export GuardDuty findings to S3 in an AWS Organization

Add your answer

Relevant content