Cannot configure Guardduty 'findings export options' to an S3 bucket

0

Under Guardduty > Settings there's an option to export findings to an S3 Bucket. It requires KMS and a KMS key that has been configured. I consistently get the following error: "Failed to configure export options because GuardDuty does not have permission to the KMS key, the S3 bucket, or the specified location in the bucket." To fix this I've tried:

  • Changing the ACL for the S3 bucket
  • Regenerating the Key

Created the key following these instructions: (see Step 3) https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_settingup.html

asked 6 months ago451 views
1 Answer
0

Hi There,

As the error message - 'Failed to configure export options because GuardDuty does not have permission to the KMS key, the S3 bucket, or the specified location in the bucket', mentions the permission related issue. There are couple of things to confirm to resolve this error -

  1. Check if your configuration to export the findings is region-specific. That means, your S3 bucket and KMS key should be in the same region, where you are performing this action.

  2. Correct S3 and KMS Key Polices.

In the key policy, GuardDuty needs the following permission [1]:

{
   "Sid": "Allow GuardDuty to use the key",
   "Effect": "Allow",
   "Principal": {
       "Service": "guardduty.amazonaws.com "
           },
           "Action": "kms:GenerateDataKey",
           "Resource": "*"
}

To export Guardduty findings to S3 bucket which is encrypted with KMS key, certain permissions are required. Please refer the below documentation link for the same. Permissions required to configure findings export: [2]

==================References==================================

[1] Granting GuardDuty permission to a KMS key: https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_exportfindings.html#guardduty_exportfindings-permissions

[2]Granting GuardDuty permissions to a bucket : https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_exportfindings.html#guardduty_exportfindings-key-policy

[3] Console Procedure - exporting findings to a bucket with the Console: https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_exportfindings.html#guardduty_exportfindings-s3-policies

[4] To know more about the option of exporting Guardduty findings, please refer the documentation - https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_exportfindings.html https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_exportfindings.html#guardduty_exportfindings-new-bucket

Please note that I personally value your feedback, please accept this answer if you find it helpful to you.

Mfanelo
answered 5 months ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions