Turn on threat detection in every account

How to do it

Use the provider's service, such as Amazon GuardDuty, Google Security Command Center or Microsoft Defender for Cloud. It reads the audit log, DNS queries and network flows, and flags stolen keys, crypto mining and calls from known bad addresses. Turn it on from the account baseline with one delegated admin account for the organization. Route findings by severity to the same pager as other alerts, as in the operations playbook. Close or suppress each finding with a written reason.

Example

resource "aws_guardduty_detector" "baseline" {
  enable = true
}

resource "aws_cloudwatch_event_rule" "high_findings" {
  name = "guardduty-high-findings"
  event_pattern = jsonencode({
    source        = ["aws.guardduty"]
    "detail-type" = ["GuardDuty Finding"]
    detail        = { severity = [{ numeric = [">=", 7] }] }
  })
}

# Run in a sandbox account. The on-call alert must arrive within 15 minutes.
aws guardduty create-sample-findings --detector-id "$(aws guardduty list-detectors --query 'DetectorIds[0]' --output text)"

How to check

Every account and region in use reports the detector as enabled. Create sample findings in a sandbox account, and the on-call alert arrives within 15 minutes.