Cannot configure Guardduty 'findings export options' to an S3 bucket

0

Under Guardduty > Settings there's an option to export findings to an S3 Bucket. It requires KMS and a KMS key that has been configured. I consistently get the following error: "Failed to configure export options because GuardDuty does not have permission to the KMS key, the S3 bucket, or the specified location in the bucket." To fix this I've tried:

  • Changing the ACL for the S3 bucket
  • Regenerating the Key

Created the key following these instructions: (see Step 3) https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_settingup.html

已提問 2 年前檢視次數 3132 次
1 個回答
0

Hi There,

As the error message - 'Failed to configure export options because GuardDuty does not have permission to the KMS key, the S3 bucket, or the specified location in the bucket', mentions the permission related issue. There are couple of things to confirm to resolve this error -

  1. Check if your configuration to export the findings is region-specific. That means, your S3 bucket and KMS key should be in the same region, where you are performing this action.

  2. Correct S3 and KMS Key Polices.

In the key policy, GuardDuty needs the following permission [1]:

{
   "Sid": "Allow GuardDuty to use the key",
   "Effect": "Allow",
   "Principal": {
       "Service": "guardduty.amazonaws.com "
           },
           "Action": "kms:GenerateDataKey",
           "Resource": "*"
}

To export Guardduty findings to S3 bucket which is encrypted with KMS key, certain permissions are required. Please refer the below documentation link for the same. Permissions required to configure findings export: [2]

==================References==================================

[1] Granting GuardDuty permission to a KMS key: https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_exportfindings.html#guardduty_exportfindings-permissions

[2]Granting GuardDuty permissions to a bucket : https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_exportfindings.html#guardduty_exportfindings-key-policy

[3] Console Procedure - exporting findings to a bucket with the Console: https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_exportfindings.html#guardduty_exportfindings-s3-policies

[4] To know more about the option of exporting Guardduty findings, please refer the documentation - https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_exportfindings.html https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_exportfindings.html#guardduty_exportfindings-new-bucket

Please note that I personally value your feedback, please accept this answer if you find it helpful to you.

Mfanelo
已回答 2 年前

您尚未登入。 登入 去張貼答案。

一個好的回答可以清楚地回答問題並提供建設性的意見回饋,同時有助於提問者的專業成長。

回答問題指南