Skip to content

Guardduty

Client

AsyncGuardDutyClient 

AsyncGuardDutyClient(config: Config | None = None, plugins: list[Plugin] | None = None)

Amazon GuardDuty is a continuous security monitoring service that analyzes and processes the following foundational data sources - VPC flow logs, Amazon Web Services CloudTrail management event logs, CloudTrail S3 data event logs, EKS audit logs, DNS logs, Amazon EBS volume data, runtime activity belonging to container workloads, such as Amazon EKS, Amazon ECS (including Amazon Web Services Fargate), and Amazon EC2 instances. It uses threat intelligence feeds, such as lists of malicious IPs and domains, and machine learning to identify unexpected, potentially unauthorized, and malicious activity within your Amazon Web Services environment. This can include issues like escalations of privileges, uses of exposed credentials, or communication with malicious IPs, domains, or presence of malware on your Amazon EC2 instances and container workloads. For example, GuardDuty can detect compromised EC2 instances and container workloads serving malware, or mining bitcoin.

GuardDuty also monitors Amazon Web Services account access behavior for signs of compromise, such as unauthorized infrastructure deployments like EC2 instances deployed in a Region that has never been used, or unusual API calls like a password policy change to reduce password strength.

GuardDuty informs you about the status of your Amazon Web Services environment by producing security findings that you can view in the GuardDuty console or through Amazon EventBridge. For more information, see the Amazon GuardDuty User Guide .

Parameters:

Name Type Description Default
config Config | None

Optional configuration for the client. Here you can set things like the endpoint for HTTP services or auth credentials.

 None
plugins list[Plugin] | None

A list of callables that modify the configuration dynamically. These can be used to set defaults, for example.

 None

Operations

Configuration

Config dataclass 

Config(*, auth_scheme_resolver: HTTPAuthSchemeResolver | None = None, auth_schemes: dict[ShapeID, AuthScheme[Any, Any, Any, Any]] | None = None, aws_access_key_id: str | None = None, aws_credentials_identity_resolver: IdentityResolver[AWSCredentialsIdentity, AWSIdentityProperties] | None = None, aws_secret_access_key: str | None = None, aws_session_token: str | None = None, endpoint_resolver: EndpointResolver | None = None, endpoint_uri: str | URI | None = None, http_request_config: HTTPRequestConfiguration | None = None, interceptors: list[_ServiceInterceptor] | None = None, protocol: ClientProtocol[Any, Any] | None = None, region: str | None = None, retry_strategy: RetryStrategy | RetryStrategyOptions | None = None, sdk_ua_app_id: str | None = None, transport: ClientTransport[Any, Any] | None = None, user_agent_extra: str | None = None)

Configuration for GuardDuty.

Attributes

auth_scheme_resolver instance-attribute 
auth_scheme_resolver: HTTPAuthSchemeResolver = auth_scheme_resolver or HTTPAuthSchemeResolver()

An auth scheme resolver that determines the auth scheme for each operation.

auth_schemes instance-attribute 
auth_schemes: dict[ShapeID, AuthScheme[Any, Any, Any, Any]] = auth_schemes or {ShapeID('aws.auth#sigv4'): SigV4AuthScheme(service='guardduty')}

A map of auth scheme ids to auth schemes.

aws_access_key_id instance-attribute 
aws_access_key_id: str | None = aws_access_key_id

The identifier for a secret access key.

aws_credentials_identity_resolver instance-attribute 
aws_credentials_identity_resolver: IdentityResolver[AWSCredentialsIdentity, AWSIdentityProperties] | None = aws_credentials_identity_resolver

Resolves AWS Credentials. Required for operations that use Sigv4 Auth.

aws_secret_access_key instance-attribute 
aws_secret_access_key: str | None = aws_secret_access_key

A secret access key that can be used to sign requests.

aws_session_token instance-attribute 
aws_session_token: str | None = aws_session_token

An access key ID that identifies temporary security credentials.

endpoint_resolver instance-attribute 
endpoint_resolver: EndpointResolver = endpoint_resolver or StandardRegionalEndpointsResolver(endpoint_prefix='guardduty')

The endpoint resolver used to resolve the final endpoint per-operation based on the configuration.

endpoint_uri instance-attribute 
endpoint_uri: str | URI | None = endpoint_uri

A static URI to route requests to.

http_request_config instance-attribute 
http_request_config: HTTPRequestConfiguration | None = http_request_config

Configuration for individual HTTP requests.

interceptors instance-attribute 
interceptors: list[_ServiceInterceptor] = interceptors or []

The list of interceptors, which are hooks that are called during the execution of a request.

protocol instance-attribute 
protocol: ClientProtocol[Any, Any] | None = protocol or RestJsonClientProtocol(_SCHEMA_GUARD_DUTY_API_SERVICE)

The protocol to serialize and deserialize requests with.

region instance-attribute 
region: str | None = region

The AWS region to connect to. The configured region is used to determine the service endpoint.

retry_strategy instance-attribute 
retry_strategy: RetryStrategy | RetryStrategyOptions | None = retry_strategy

The retry strategy or options for configuring retry behavior. Can be either a configured RetryStrategy or RetryStrategyOptions to create one.

sdk_ua_app_id instance-attribute 
sdk_ua_app_id: str | None = sdk_ua_app_id

A unique and opaque application ID that is appended to the User-Agent header.

transport instance-attribute 
transport: ClientTransport[Any, Any] | None = transport or AIOHTTPClient()

The transport to use to send requests (e.g. an HTTP client).

user_agent_extra instance-attribute 
user_agent_extra: str | None = user_agent_extra

Additional suffix to be added to the User-Agent header.

Methods:

set_auth_scheme 
set_auth_scheme(scheme: AuthScheme[Any, Any, Any, Any]) -> None

Sets the implementation of an auth scheme.

Using this method ensures the correct key is used.

Parameters:

Name Type Description Default
scheme AuthScheme[Any, Any, Any, Any]

The auth scheme to add.

 required

Plugin module-attribute 

Plugin: TypeAlias = Callable[[Config], None]

A callable that allows customizing the config object on each request.

Structures

Errors

Enums