Service-linked role permissions for GuardDuty
GuardDuty uses the service-linked role (SLR) named AWSServiceRoleForAmazonGuardDuty
. The SLR allows
GuardDuty to perform the following tasks. It also allows GuardDuty to include the retrieved metadata
belonging to the EC2 instance in the findings that GuardDuty may generate about the potential
threat. The AWSServiceRoleForAmazonGuardDuty
service-linked role trusts the
guardduty.amazonaws.com
service to assume the role.
With this permissions policy, GuardDuty can perform the following tasks:
-
Use Amazon EC2 actions to manage and retrieve information about your EC2 instances, images, and networking components such as VPCs, subnets, transit gateways, and security groups.
-
Use AWS Organizations actions to describe associated accounts.
-
Use Amazon S3 actions to retrieve information about S3 buckets and objects.
-
Use AWS Lambda actions to retrieve information about your Lambda functions and tags.
-
Use Amazon EKS actions to manage and retrieve information about the EKS clusters and manage Amazon EKS add-ons on EKS clusters. The EKS actions also retrieve the information about the tags associated to GuardDuty.
-
Use IAM to create the Service-linked role permissions for Malware Protection after Malware Protection has been enabled.
The role is configured with the following AWS managed policy, named AmazonGuardDutyServiceRolePolicy
.
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeImages", "ec2:DescribeVpcEndpoints", "ec2:DescribeSubnets", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeTransitGatewayAttachments", "organizations:ListAccounts", "organizations:DescribeAccount", "s3:GetBucketPublicAccessBlock", "s3:GetEncryptionConfiguration", "s3:GetBucketTagging", "s3:GetAccountPublicAccessBlock", "s3:ListAllMyBuckets", "s3:GetBucketAcl", "s3:GetBucketPolicy", "s3:GetBucketPolicyStatus", "lambda:GetFunctionConfiguration", "lambda:ListTags", "eks:ListClusters", "eks:DescribeCluster", "ec2:DescribeVpcEndpointServices", "ec2:DescribeSecurityGroups" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName": "malware-protection.guardduty.amazonaws.com" } } }, { "Effect": "Allow", "Action": "ec2:CreateVpcEndpoint", "Resource": "arn:aws:ec2:*:*:vpc-endpoint/*", "Condition": { "ForAnyValue:StringEquals": { "aws:TagKeys": "GuardDutyManaged" }, "StringLike": { "ec2:VpceServiceName": [ "com.amazonaws.*.guardduty-data", "com.amazonaws.*.guardduty-data-fips" ] } } }, { "Effect": "Allow", "Action": [ "ec2:ModifyVpcEndpoint", "ec2:DeleteVpcEndpoints" ], "Resource": "arn:aws:ec2:*:*:vpc-endpoint/*", "Condition": { "Null": { "aws:ResourceTag/GuardDutyManaged": false } } }, { "Effect": "Allow", "Action": [ "ec2:CreateVpcEndpoint", "ec2:ModifyVpcEndpoint" ], "Resource": [ "arn:aws:ec2:*:*:vpc/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:subnet/*" ] }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*:*:vpc-endpoint/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CreateVpcEndpoint" }, "ForAnyValue:StringEquals": { "aws:TagKeys": "GuardDutyManaged" } } }, { "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupIngress", "ec2:AuthorizeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:RevokeSecurityGroupEgress", "ec2:DeleteSecurityGroup" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "Null": { "aws:ResourceTag/GuardDutyManaged": false } } }, { "Effect": "Allow", "Action": "ec2:CreateSecurityGroup", "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "StringLike": { "aws:RequestTag/GuardDutyManaged": "*" } } }, { "Effect": "Allow", "Action": "ec2:CreateSecurityGroup", "Resource": "arn:aws:ec2:*:*:vpc/*" }, { "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CreateSecurityGroup" }, "ForAnyValue:StringEquals": { "aws:TagKeys": "GuardDutyManaged" } } }, { "Effect": "Allow", "Action": "eks:CreateAddon", "Resource": "arn:aws:eks:*:*:cluster/*", "Condition": { "ForAnyValue:StringEquals": { "aws:TagKeys": "GuardDutyManaged" } } }, { "Effect": "Allow", "Action": [ "eks:DeleteAddon", "eks:UpdateAddon", "eks:DescribeAddon" ], "Resource": "arn:aws:eks:*:*:addon/*/aws-guardduty-agent/*" }, { "Effect": "Allow", "Action": "eks:TagResource", "Resource": "arn:aws:eks:*:*:cluster/*", "Condition": { "ForAnyValue:StringEquals": { "aws:TagKeys": "GuardDutyManaged" } } } ] }
The following is the trust policy that is attached to the AWSServiceRoleForAmazonGuardDuty
service-linked role:
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Service": "guardduty.amazonaws.com" }, "Action": "sts:AssumeRole" } ] }
Creating a service-linked role for GuardDuty
The AWSServiceRoleForAmazonGuardDuty
service-linked role is automatically created when you
enable GuardDuty for the first time or enable GuardDuty in a supported Region where you previously
didn't have it enabled. You can also create the service-linked role manually using
the IAM console, the AWS CLI, or the IAM API.
Important
The service-linked role that is created for the GuardDuty delegated administrator account doesn't apply to the member GuardDuty accounts.
You must configure permissions to allow an IAM principal (such as a user, group, or
role) to create, edit, or delete a service-linked role. For the AWSServiceRoleForAmazonGuardDuty
service-linked role to be successfully created, the IAM principal that you use GuardDuty with
must have the required permissions. To grant the required permissions, attach the following
policy to this user, group, or role:
Note
Replace the sample account ID
in the following example with
your actual AWS account ID.
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "guardduty:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "arn:aws:iam::
123456789012
:role/aws-service-role/guardduty.amazonaws.com/AWSServiceRoleForAmazonGuardDuty", "Condition": { "StringLike": { "iam:AWSServiceName": "guardduty.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "iam:PutRolePolicy", "iam:DeleteRolePolicy" ], "Resource": "arn:aws:iam::123456789012
:role/aws-service-role/guardduty.amazonaws.com/AWSServiceRoleForAmazonGuardDuty" } ] }
For more information about creating the role manually, see Creating a service-linked role in the IAM User Guide.
Editing a service-linked role for GuardDuty
GuardDuty doesn't allow you to edit the AWSServiceRoleForAmazonGuardDuty
service-linked role.
After you create a service-linked role, you can't change the name of the role because
various entities might reference the role. However, you can edit the description of the role
using IAM. For more information, see Editing a
service-linked role in the IAM User Guide.
Deleting a service-linked role for GuardDuty
If you no longer need to use a feature or service that requires a service-linked role, we recommend that you delete that role. That way you don't have an unused entity that isn't actively monitored or maintained.
Important
If you have enabled Malware Protection, deleting AWSServiceRoleForAmazonGuardDuty
doesn't
automatically delete AWSServiceRoleForAmazonGuardDutyMalwareProtection
. If you want to delete
AWSServiceRoleForAmazonGuardDutyMalwareProtection
, see Deleting a service-linked role for
Malware Protection.
You must first disable GuardDuty in all Regions where it is enabled in order to delete the
AWSServiceRoleForAmazonGuardDuty
. If the GuardDuty service isn't disabled when you try to delete the
service-linked role, the deletion fails. For more information, see Suspending or disabling GuardDuty.
When you disable GuardDuty, the AWSServiceRoleForAmazonGuardDuty
doesn't get deleted
automatically. If you enable GuardDuty again, it'll start using the existing
AWSServiceRoleForAmazonGuardDuty
.
To manually delete the service-linked role using IAM
Use the IAM console, the AWS CLI, or the IAM API to delete the
AWSServiceRoleForAmazonGuardDuty
service-linked role. For more information, see Deleting a
service-linked role in the IAM User Guide.
Supported AWS Regions
Amazon GuardDuty supports using the AWSServiceRoleForAmazonGuardDuty
service-linked role in all the
AWS Regions where GuardDuty is available. For a list of Regions where GuardDuty is currently
available, see Amazon GuardDuty endpoints and quotas in the
Amazon Web Services General Reference.