Zakaria
86 lines
4.4 KiB
Markdown
86 lines
4.4 KiB
Markdown
# GuardDuty
|
|
|
|
**Protocol:** REST JSON
|
|
|
|
**Endpoint:** `http://localhost:4566`
|
|
|
|
Floci implements the GuardDuty detector management lifecycle and organization-configuration
|
|
readback for local SDK, CLI, and Terraform workflows. Detectors are isolated by account and
|
|
region and use the configured Floci storage mode.
|
|
|
|
## Supported Operations
|
|
|
|
| Operation | Method and path | Description |
|
|
|---|---|---|
|
|
| `CreateDetector` | `POST /detector` | Create the account's detector (one per account and region) |
|
|
| `GetDetector` | `GET /detector/{detectorId}` | Return detector status, frequency, features, and tags |
|
|
| `UpdateDetector` | `POST /detector/{detectorId}` | Update status, frequency, and features |
|
|
| `DeleteDetector` | `DELETE /detector/{detectorId}` | Delete the detector |
|
|
| `ListDetectors` | `GET /detector` | List detector IDs with pagination |
|
|
| `DescribeOrganizationConfiguration` | `GET /detector/{detectorId}/admin` | Return organization auto-enablement configuration |
|
|
| `UpdateOrganizationConfiguration` | `POST /detector/{detectorId}/admin` | Update organization auto-enablement configuration |
|
|
| `EnableOrganizationAdminAccount` | `POST /admin/enable` | Designate the delegated administrator account |
|
|
| `DisableOrganizationAdminAccount` | `POST /admin/disable` | Remove the delegated administrator account |
|
|
| `ListOrganizationAdminAccounts` | `GET /admin` | List the delegated administrator account |
|
|
| `CreateMembers` | `POST /detector/{detectorId}/member` | Create GuardDuty member accounts for a detector |
|
|
| `ListMembers` | `GET /detector/{detectorId}/member` | List detector members with pagination and association filtering |
|
|
| `TagResource` | `POST /tags/{resourceArn}` | Add tags to a detector |
|
|
| `UntagResource` | `DELETE /tags/{resourceArn}` | Remove tags from a detector |
|
|
| `ListTagsForResource` | `GET /tags/{resourceArn}` | List detector tags |
|
|
|
|
Feature lists and each feature's `additionalConfiguration` list are returned in the order
|
|
they were submitted, so Terraform's ordered list blocks re-plan cleanly. A missing detector
|
|
is reported as `BadRequestException` with the exact message the Terraform AWS provider
|
|
matches for not-found detection, mirroring AWS.
|
|
|
|
## Configuration
|
|
|
|
| Variable | Default | Description |
|
|
|---|---|---|
|
|
| `FLOCI_SERVICES_GUARDDUTY_ENABLED` | `true` | Enable or disable GuardDuty |
|
|
| `FLOCI_STORAGE_SERVICES_GUARDDUTY_MODE` | *(inherits global)* | Optional GuardDuty storage-mode override |
|
|
| `FLOCI_STORAGE_SERVICES_GUARDDUTY_FLUSH_INTERVAL_MS` | `5000` | Hybrid storage flush interval in milliseconds |
|
|
|
|
Unless a GuardDuty-specific override is set, detector state follows the global
|
|
`FLOCI_STORAGE_MODE` setting. Persistent, hybrid, and write-ahead-log modes restore
|
|
detectors across restarts.
|
|
|
|
## Example
|
|
|
|
```bash
|
|
export AWS_ENDPOINT_URL=http://localhost:4566
|
|
|
|
DETECTOR_ID=$(aws guardduty create-detector \
|
|
--enable \
|
|
--finding-publishing-frequency SIX_HOURS \
|
|
--tags env=local \
|
|
--query DetectorId --output text)
|
|
|
|
aws guardduty get-detector --detector-id "$DETECTOR_ID"
|
|
aws guardduty list-detectors
|
|
|
|
aws guardduty update-organization-configuration \
|
|
--detector-id "$DETECTOR_ID" \
|
|
--auto-enable-organization-members ALL
|
|
aws guardduty describe-organization-configuration --detector-id "$DETECTOR_ID"
|
|
|
|
aws guardduty delete-detector --detector-id "$DETECTOR_ID"
|
|
```
|
|
|
|
## Current Scope
|
|
|
|
- Detector status, finding-publishing frequency, features (including
|
|
`additionalConfiguration` sub-features), tags, and timestamps are modeled.
|
|
- Organization semantics are readback-only. Floci has no Organizations service, so
|
|
`adminAccountId` membership is not validated, delegated-administrator permissions are not
|
|
enforced on the organization endpoints, and auto-enablement is never fanned out to member
|
|
accounts. Organization configuration is stored per calling account and echoed back as
|
|
submitted — sufficient for Terraform's `aws_guardduty_organization_configuration`,
|
|
`aws_guardduty_organization_configuration_feature`, and
|
|
`aws_guardduty_organization_admin_account` resources in a single-account workflow.
|
|
- No findings are generated: detection, malware scans, and the findings APIs
|
|
(`ListFindings`, `GetFindings`, filters, and publishing destinations) are not implemented.
|
|
- Member creation and listing are implemented. Invitation, IP-set, threat-intel, and coverage APIs are not implemented.
|
|
- The deprecated `dataSources` request/response structures are not modeled; the Terraform
|
|
provider treats their absence as "not configured".
|