second first commit

2026-09-22 08:57:00 -04:00
parent e88d7e2ff3
commit 0aef7fb2d8
4766 changed files with 1236986 additions and 0 deletions
@@ -0,0 +1,85 @@
+# GuardDuty
+
+**Protocol:** REST JSON
+
+**Endpoint:** `http://localhost:4566`
+
+Floci implements the GuardDuty detector management lifecycle and organization-configuration
+readback for local SDK, CLI, and Terraform workflows. Detectors are isolated by account and
+region and use the configured Floci storage mode.
+
+## Supported Operations
+
+| Operation | Method and path | Description |
+|---|---|---|
+| `CreateDetector` | `POST /detector` | Create the account's detector (one per account and region) |
+| `GetDetector` | `GET /detector/{detectorId}` | Return detector status, frequency, features, and tags |
+| `UpdateDetector` | `POST /detector/{detectorId}` | Update status, frequency, and features |
+| `DeleteDetector` | `DELETE /detector/{detectorId}` | Delete the detector |
+| `ListDetectors` | `GET /detector` | List detector IDs with pagination |
+| `DescribeOrganizationConfiguration` | `GET /detector/{detectorId}/admin` | Return organization auto-enablement configuration |
+| `UpdateOrganizationConfiguration` | `POST /detector/{detectorId}/admin` | Update organization auto-enablement configuration |
+| `EnableOrganizationAdminAccount` | `POST /admin/enable` | Designate the delegated administrator account |
+| `DisableOrganizationAdminAccount` | `POST /admin/disable` | Remove the delegated administrator account |
+| `ListOrganizationAdminAccounts` | `GET /admin` | List the delegated administrator account |
+| `CreateMembers` | `POST /detector/{detectorId}/member` | Create GuardDuty member accounts for a detector |
+| `ListMembers` | `GET /detector/{detectorId}/member` | List detector members with pagination and association filtering |
+| `TagResource` | `POST /tags/{resourceArn}` | Add tags to a detector |
+| `UntagResource` | `DELETE /tags/{resourceArn}` | Remove tags from a detector |
+| `ListTagsForResource` | `GET /tags/{resourceArn}` | List detector tags |
+
+Feature lists and each feature's `additionalConfiguration` list are returned in the order
+they were submitted, so Terraform's ordered list blocks re-plan cleanly. A missing detector
+is reported as `BadRequestException` with the exact message the Terraform AWS provider
+matches for not-found detection, mirroring AWS.
+
+## Configuration
+
+| Variable | Default | Description |
+|---|---|---|
+| `FLOCI_SERVICES_GUARDDUTY_ENABLED` | `true` | Enable or disable GuardDuty |
+| `FLOCI_STORAGE_SERVICES_GUARDDUTY_MODE` | *(inherits global)* | Optional GuardDuty storage-mode override |
+| `FLOCI_STORAGE_SERVICES_GUARDDUTY_FLUSH_INTERVAL_MS` | `5000` | Hybrid storage flush interval in milliseconds |
+
+Unless a GuardDuty-specific override is set, detector state follows the global
+`FLOCI_STORAGE_MODE` setting. Persistent, hybrid, and write-ahead-log modes restore
+detectors across restarts.
+
+## Example
+
+```bash
+export AWS_ENDPOINT_URL=http://localhost:4566
+
+DETECTOR_ID=$(aws guardduty create-detector \
+  --enable \
+  --finding-publishing-frequency SIX_HOURS \
+  --tags env=local \
+  --query DetectorId --output text)
+
+aws guardduty get-detector --detector-id "$DETECTOR_ID"
+aws guardduty list-detectors
+
+aws guardduty update-organization-configuration \
+  --detector-id "$DETECTOR_ID" \
+  --auto-enable-organization-members ALL
+aws guardduty describe-organization-configuration --detector-id "$DETECTOR_ID"
+
+aws guardduty delete-detector --detector-id "$DETECTOR_ID"
+```
+
+## Current Scope
+
+- Detector status, finding-publishing frequency, features (including
+  `additionalConfiguration` sub-features), tags, and timestamps are modeled.
+- Organization semantics are readback-only. Floci has no Organizations service, so
+  `adminAccountId` membership is not validated, delegated-administrator permissions are not
+  enforced on the organization endpoints, and auto-enablement is never fanned out to member
+  accounts. Organization configuration is stored per calling account and echoed back as
+  submitted — sufficient for Terraform's `aws_guardduty_organization_configuration`,
+  `aws_guardduty_organization_configuration_feature`, and
+  `aws_guardduty_organization_admin_account` resources in a single-account workflow.
+- No findings are generated: detection, malware scans, and the findings APIs
+  (`ListFindings`, `GetFindings`, filters, and publishing destinations) are not implemented.
+- Member creation and listing are implemented. Invitation, IP-set, threat-intel, and coverage APIs are not implemented.
+- The deprecated `dataSources` request/response structures are not modeled; the Terraform
+  provider treats their absence as "not configured".