How would I use CloudFormation to configure GuardDuty findings export to S3?

Question

I would like to take an IaaC approach to configuring GuardDuty to export its findings to a S3 bucket.

I've successfully managed to do this via button clicks in the console, examined the bucket policy and know the permissions for s3 and KMS needed to be given to GuardDuty for this.

However, when it comes to the CloudFormation template, the "AWS::GuardDuty::Detector" resource documentation describes a "FindingPublishingFrequency" property, but there doesn't seem to be a property for specifying which bucket the finding is supposed to be published into. Do I use the "Features" property? If so, what would the "CFNFeatureConfiguration" array I am supposed to specify look like?

Answer

Hi,

One way to achieve what you want is to go via the events generated by GuardDuty on it findings

When you catch those events, you can start doing all kinds of advanced things to achieve your goal: write those events to SQS, trigger a Lambda reading the queue to write to S3, etc.

This article will detail the steps and provide code on how to achieve it: https://medium.com/@epselon/aws-guardduty-managed-setup-with-cloudformation-41a38e17aa2f

Best,

Didier

How would I use CloudFormation to configure GuardDuty findings export to S3?

Relevant content