> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# GuardDuty Centralized Enablement

### More Info:

This rule checks if Amazon GuardDuty is enabled in your AWS account and AWS Region. If you provide an AWS account for centralization, the rule evaluates the GuardDuty results in the centralized account. The rule is COMPLIANT when GuardDuty is enabled.

### Risk Level

Low

### Address

Security

### Compliance Standards

* APRA CPS 234 (Australia)
* AWS Startup Security Baseline
* BSI C5 (Germany)
* Brazil LGPD
* CCPA / CPRA (California)
* CIS Critical Security Controls v8
* CMMC 2.0
* CSA Cloud Controls Matrix v4
* DPDPA
* Digital Operational Resilience Act (EU)
* ISO/IEC 27017
* ISO/IEC 27018
* ISO/IEC 27701
* KSA PDPL
* MAS Technology Risk Management (Singapore)
* MITRE ATT\&CK (Cloud)
* NIS2 Directive
* NIST SP 800-171
* NYDFS 23 NYCRR 500
* Reserve Bank of India (RBI) Master Direction – Information Technology Framework
* SWIFT Customer Security Controls Framework
* Sarbanes-Oxley IT General Controls
* UK NCSC Cyber Assessment Framework

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the misconfiguration of GuardDuty Centralized Enablement for AWS Shield using the AWS console, follow these step-by-step instructions:

        1. **Sign in to the AWS Management Console**: Go to [https://aws.amazon.com/](https://aws.amazon.com/) and sign in to the AWS Management Console using your credentials.

        2. **Navigate to the GuardDuty Service**: In the AWS Management Console, search for "GuardDuty" in the search bar at the top of the page and select the GuardDuty service from the search results.

        3. **Enable GuardDuty**: If GuardDuty is not already enabled, click on the "Enable GuardDuty" button to enable the service in your AWS account.

        4. **Configure GuardDuty**: Follow the on-screen instructions to configure GuardDuty for your account. Make sure to select the appropriate settings based on your requirements.

        5. **Enable Centralized Management**: In the GuardDuty console, navigate to the "Settings" tab on the left-hand side menu.

        6. **Enable Centralized Management**: In the Settings page, locate the "Enable Centralized Management" option and click on the "Edit" button next to it.

        7. **Enable Centralized Management**: In the Edit Centralized Management Settings page, select the option to enable centralized management for GuardDuty.

        8. **Save Changes**: Click on the "Save" button to save the changes and enable centralized management for GuardDuty.

        9. **Verify Centralized Management**: Once the changes are saved, verify that centralized management is enabled by checking the status in the GuardDuty console.

        By following these steps, you will be able to remediate the misconfiguration of GuardDuty Centralized Enablement for AWS Shield using the AWS console.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the misconfiguration of GuardDuty Centralized Enablement for AWS Shield using AWS CLI, follow these steps:

        1. **List all regions where GuardDuty is not enabled:**

        ```bash theme={null}
        aws guardduty list-detectors --region <region-name>
        ```

        2. **Enable GuardDuty in the desired region:**

        ```bash theme={null}
        aws guardduty create-detector --enable --region <region-name>
        ```

        3. **Enable Centralized GuardDuty Management:**
           * Open the AWS Management Console.
           * Go to the GuardDuty service.
           * Click on the "Settings" tab.
           * Enable the "Enable GuardDuty Centralized Management" option.

        4. **Enable AWS Shield Advanced:**
           * Open the AWS Management Console.
           * Go to the AWS Shield service.
           * Click on "Activate AWS Shield Advanced".
           * Follow the on-screen instructions to complete the activation.

        5. **Verify GuardDuty and AWS Shield configuration:**
           * Use the following command to verify that GuardDuty is enabled in all regions:
           ```bash theme={null}
           aws guardduty list-detectors
           ```
           * Use the following command to verify that AWS Shield Advanced is enabled:
           ```bash theme={null}
           aws shield describe-attack
           ```

        By following these steps, you can remediate the misconfiguration of GuardDuty Centralized Enablement for AWS Shield using AWS CLI.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the "GuardDuty Centralized Enablement" misconfiguration for AWS Shield using Python, you can follow these steps:

        1. Import the necessary Python libraries:

        ```python theme={null}
        import boto3
        ```

        2. Connect to AWS using the Boto3 library:

        ```python theme={null}
        client = boto3.client('shield')
        ```

        3. Disable GuardDuty Centralized Enablement:

        ```python theme={null}
        response = client.update_subscription(
            AutoRenew=True,
            Enabled=False
        )
        ```

        4. Verify that GuardDuty Centralized Enablement has been successfully disabled:

        ```python theme={null}
        if response['ResponseMetadata']['HTTPStatusCode'] == 200:
            print("GuardDuty Centralized Enablement has been successfully disabled.")
        else:
            print("Failed to disable GuardDuty Centralized Enablement.")
        ```

        By following these steps, you can remediate the "GuardDuty Centralized Enablement" misconfiguration for AWS Shield using Python.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "aws_guardduty_detector" "this" {
          # Enable Amazon GuardDuty in this account and region
          enable = true

          # Optional: supply tags if required by your org
          tags = {
            Name        = "GUARDDUTY_DETECTOR_NAME" # replace with a descriptive name
            Environment = "ENVIRONMENT_NAME"        # e.g., "prod", "dev"
          }
        }
        ```

        Enabling this may incur additional GuardDuty charges; if a detector already exists in this account/region, import it into this resource (`terraform import aws_guardduty_detector.this DETECTOR_ID`) instead of creating a new one, or the apply will fail.

        `terraform plan` should show one new `aws_guardduty_detector.this` resource to be created with `enable = true` and no changes to existing resources.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://docs.aws.amazon.com/config/latest/developerguide/guardduty-enabled-centralized.html](https://docs.aws.amazon.com/config/latest/developerguide/guardduty-enabled-centralized.html)