How can I confirm if GuardDuty logs are consolidated in one account?

Having a central GuardDuty (delegated administrator) is the best practice in a multi-account environment. Member accounts join the central GuardDuty and consolidate all findings there. Central GuardDuty can store logs/finding in an S3 bucket.

Another option is to have independent GuardDuty service in every AWS account and you can make them send logs to the same S3 buket in different folders (prefixes), but this is not so convenient.

1/ Navigate to GuardDuty in the main account (payer) in your organization. Choose settings, and you will see which account is the Delegated Administrator. 2/ Login to that account and go to the GuardDuty console. 3/ Choose settings, Accounts. You will see a list of every account in the organization, and if GuardDuty is enabled. 4/ You will have to repeat this for each Region you want GuardDuty enabled in.

You can enable Export findings from the GuardDuty administrator account. It will include the findings from all associated member accounts that are generated in that Region. https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_exportfindings.html?icmpid=docs_gd_help_panel

Amazon GuardDuty supports the consolidation of these findings to one AWS account to support centralized log management. You must choose a one of AWS accounts to be the central log account for GuardDuty. There are two ways to associate accounts

1. By sending an invitation through GuardDuty. Additional for multiple accounts, you can add child accounts by using the “Upload List (.csv)”.
2. Throughout an AWS Organization that all accounts are members of.

Once child accounts has accepted the invitation, all the findings log in the secondary account will now be sent to the central log account.

After that, look back in GuardDuty central log account, the status of invited account will now be “Enable”

All GuardDuty logs will be stored in central log account which is in an S3 bucket of central log account.

For more detail, please visit https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_accounts.html .