Manage GuardDuty enablement centrally with Organizations declarative policies!
Hi everyone, Shii-chan here! Here's good news if you run many AWS accounts!
AWS What's New
aws.amazon.com
What was announced?
According to AWS What's New, Amazon GuardDuty now supports AWS Organizations declarative policies. With an organization policy, you can centrally enable GuardDuty threat detection across every account and Region in your organization. The configuration applies to existing accounts and is automatically maintained as new accounts join.
The story so far
Previously, keeping enablement aligned across a large multi-account, multi-Region environment meant configuring GuardDuty's enablement settings separately in each Region, which could drift over time.
What changes
From your delegated administrator account, you can define a central GuardDuty policy that sets an enablement baseline across your organization.
- Apply it at the organization root, OUs, or individual accounts
- A default configuration applies in every Region where GuardDuty is available
- Per-Region overrides are available for Regions that need different enablement
Dive Deep
Enablement set by a policy cannot be overridden via the GuardDuty console or API, which helps prevent gaps from accidental disabling.
To get started, make sure the delegated administrator has permission to manage GuardDuty policies. Then sign in to the GuardDuty console and choose Organization policies, or create a policy another way.
It is available in all AWS commercial Regions and the AWS GovCloud (US) Regions.
Wrap-up
- GuardDuty supports Organizations declarative policies
- Define an enablement baseline at the root, OU, or account level
- Default configuration plus per-Region overrides
- Policy-set enablement cannot be overridden in the console or API
- Available in commercial Regions and GovCloud (US)
This is great for security teams who want consistent detection coverage across many accounts!
