AWS::GuardDuty::Detector - Amazon CloudFormation
SyntaxPropertiesReturn valuesExamples
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

This is the new Amazon CloudFormation Template Reference Guide. Please update your bookmarks and links. For help getting started with CloudFormation, see the Amazon CloudFormation User Guide.

AWS::GuardDuty::Detector

The AWS::GuardDuty::Detector resource specifies a new GuardDuty detector. A detector is an object that represents the GuardDuty service. A detector is required for GuardDuty to become operational.

Make sure you use either DataSources or Features in a one request, and not both.

Syntax

To declare this entity in your Amazon CloudFormation template, use the following syntax:

JSON

{
  "Type" : "AWS::GuardDuty::Detector",
  "Properties" : {
      "DataSources" : CFNDataSourceConfigurations,
      "Enable" : Boolean,
      "Features" : [ CFNFeatureConfiguration, ... ],
      "FindingPublishingFrequency" : String,
      "Tags" : [ TagItem, ... ]
    }
}

YAML

Type: AWS::GuardDuty::Detector
Properties:
  DataSources: 
    CFNDataSourceConfigurations
  Enable: Boolean
  Features: 
    - CFNFeatureConfiguration
  FindingPublishingFrequency: String
  Tags: 
    - TagItem

Properties

DataSources

Describes which data sources will be enabled for the detector.

Required: No

Type: CFNDataSourceConfigurations

Update requires: No interruption

Enable

Specifies whether the detector is to be enabled on creation.

Required: Yes

Type: Boolean

Update requires: No interruption

Features

A list of features that will be configured for the detector.

Required: No

Type: Array of CFNFeatureConfiguration

Update requires: No interruption

FindingPublishingFrequency

Specifies how frequently updated findings are exported.

Required: No

Type: String

Allowed values: FIFTEEN_MINUTES | ONE_HOUR | SIX_HOURS

Update requires: No interruption

Tags

Specifies tags added to a new detector resource. Each tag consists of a key and an optional value, both of which you define.

Currently, support is available only for creating and deleting a tag. No support exists for updating the tags.

For more information, see Tag.

Required: No

Type: Array of TagItem

Update requires: No interruption

Return values

Ref

When you pass the logical ID of this resource to the intrinsic Ref function, Ref returns the unique ID of the detector.

For more information about using the Ref function, see Ref.

Fn::GetAtt

The Fn::GetAtt intrinsic function returns a value for a specified attribute of this type. The following are the available attributes and sample return values.

For more information about using the Fn::GetAtt intrinsic function, see Fn::GetAtt.

Id

The unique ID of the detector.

Examples

Declare a Detector Resource

The following example shows how to declare a GuardDutyDetector resource:

JSON

"mydetector": {
    "Type" : "AWS::GuardDuty::Detector",
    "Properties" : {
        "Enable" : True,
        "FindingPublishingFrequency" : "FIFTEEN_MINUTES"
    }
}

YAML

mydetector:
    Type: AWS::GuardDuty::Detector
    Properties:
        Enable: True
        FindingPublishingFrequency: FIFTEEN_MINUTES