Operations Actions Resource types Condition keys

Actions, resources, and condition keys for Amazon GuardDuty

Amazon GuardDuty (service prefix: guardduty) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by Amazon GuardDuty
Actions defined by Amazon GuardDuty
Resource types defined by Amazon GuardDuty
Condition keys for Amazon GuardDuty

API operations defined by Amazon GuardDuty

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Condition key	Possible value(s)	Access level
AcceptAdministratorInvitation	guardduty:AcceptAdministratorInvitation			Write
AcceptInvitation	guardduty:AcceptInvitation			Write
ArchiveFindings	guardduty:ArchiveFindings			Write
CreateDetector	guardduty:CreateDetector			Write
CreateDetector	guardduty:TagResource			Tagging, Write
CreateFilter	guardduty:CreateFilter			Write
CreateFilter	guardduty:TagResource			Tagging, Write
CreateIPSet	guardduty:CreateIPSet			Write
CreateIPSet	guardduty:TagResource			Tagging, Write
CreateInvestigation	guardduty:CreateInvestigation			Write
CreateMalwareProtectionPlan	guardduty:CreateMalwareProtectionPlan			Write
	guardduty:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	malware-protection-plan.guardduty.amazonaws.com	Write
CreateMembers	guardduty:CreateMembers			Write
CreatePublishingDestination	guardduty:CreatePublishingDestination			Write
CreatePublishingDestination	guardduty:TagResource			Tagging, Write
CreateSampleFindings	guardduty:CreateSampleFindings			Write
CreateThreatEntitySet	guardduty:CreateThreatEntitySet			Write
CreateThreatEntitySet	guardduty:TagResource			Tagging, Write
CreateThreatIntelSet	guardduty:CreateThreatIntelSet			Write
CreateThreatIntelSet	guardduty:TagResource			Tagging, Write
CreateTrustedEntitySet	guardduty:CreateTrustedEntitySet			Write
CreateTrustedEntitySet	guardduty:TagResource			Tagging, Write
DeclineInvitations	guardduty:DeclineInvitations			Write
DeleteDetector	guardduty:DeleteDetector			Write
DeleteFilter	guardduty:DeleteFilter			Write
DeleteIPSet	guardduty:DeleteIPSet			Write
DeleteInvitations	guardduty:DeleteInvitations			Write
DeleteMalwareProtectionPlan	guardduty:DeleteMalwareProtectionPlan			Write
DeleteMembers	guardduty:DeleteMembers			Write
DeletePublishingDestination	guardduty:DeletePublishingDestination			Write
DeleteThreatEntitySet	guardduty:DeleteThreatEntitySet			Write
DeleteThreatIntelSet	guardduty:DeleteThreatIntelSet			Write
DeleteTrustedEntitySet	guardduty:DeleteTrustedEntitySet			Write
DescribeMalwareScans	guardduty:DescribeMalwareScans			Read
DescribeOrganizationConfiguration	guardduty:DescribeOrganizationConfiguration			Read
DescribePublishingDestination	guardduty:DescribePublishingDestination			Read
DisableOrganizationAdminAccount	guardduty:DisableOrganizationAdminAccount			Write
DisassociateFromAdministratorAccount	guardduty:DisassociateFromAdministratorAccount			Write
DisassociateFromMasterAccount	guardduty:DisassociateFromMasterAccount			Write
DisassociateMembers	guardduty:DisassociateMembers			Write
EnableOrganizationAdminAccount	guardduty:EnableOrganizationAdminAccount			Write
GetAdministratorAccount	guardduty:GetAdministratorAccount			Read
GetCoverageStatistics	guardduty:GetCoverageStatistics			Read
GetDetector	guardduty:GetDetector			Read
GetFilter	guardduty:GetFilter			Read
GetFindings	guardduty:GetFindings			Read
GetFindingsStatistics	guardduty:GetFindingsStatistics			Read
GetIPSet	guardduty:GetIPSet			Read
GetInvestigation	guardduty:GetInvestigation			Read
GetInvitationsCount	guardduty:GetInvitationsCount			Read
GetMalwareProtectionPlan	guardduty:GetMalwareProtectionPlan			Read
GetMalwareScan	guardduty:GetMalwareScan			Read
GetMalwareScanSettings	guardduty:GetMalwareScanSettings			Read
GetMasterAccount	guardduty:GetMasterAccount			Read
GetMemberDetectors	guardduty:GetMemberDetectors			Read
GetMembers	guardduty:GetMembers			Read
GetOrganizationStatistics	guardduty:GetOrganizationStatistics			Read
GetRemainingFreeTrialDays	guardduty:GetRemainingFreeTrialDays			Read
GetThreatEntitySet	guardduty:GetThreatEntitySet			Read
GetThreatIntelSet	guardduty:GetThreatIntelSet			Read
GetTrustedEntitySet	guardduty:GetTrustedEntitySet			Read
GetUsageStatistics	guardduty:GetUsageStatistics			Read
InviteMembers	guardduty:InviteMembers			Write
ListCoverage	guardduty:ListCoverage			List
ListDetectors	guardduty:ListDetectors			List
ListFilters	guardduty:ListFilters			List
ListFindings	guardduty:ListFindings			List
ListIPSets	guardduty:ListIPSets			List
ListInvestigations	guardduty:ListInvestigations			List
ListInvitations	guardduty:ListInvitations			List
ListMalwareProtectionPlans	guardduty:ListMalwareProtectionPlans			List
ListMalwareScans	guardduty:ListMalwareScans			List
ListMembers	guardduty:ListMembers			List
ListOrganizationAdminAccounts	guardduty:ListOrganizationAdminAccounts			List
ListPublishingDestinations	guardduty:ListPublishingDestinations			List
ListTagsForResource	guardduty:ListTagsForResource			Read
ListThreatEntitySets	guardduty:ListThreatEntitySets			List
ListThreatIntelSets	guardduty:ListThreatIntelSets			List
ListTrustedEntitySets	guardduty:ListTrustedEntitySets			List
SendObjectMalwareScan	guardduty:SendObjectMalwareScan			Write
StartMalwareScan	guardduty:StartMalwareScan			Write
StartMalwareScan	iam:PassRole	iam:PassedToService	malware-protection.guardduty.amazonaws.com	Write
StartMonitoringMembers	guardduty:StartMonitoringMembers			Write
StopMonitoringMembers	guardduty:StopMonitoringMembers			Write
TagResource	guardduty:TagResource			Tagging, Write
UnarchiveFindings	guardduty:UnarchiveFindings			Write
UntagResource	guardduty:UntagResource			Tagging, Write
UpdateDetector	guardduty:UpdateDetector			Write
UpdateFilter	guardduty:UpdateFilter			Write
UpdateFindingsFeedback	guardduty:UpdateFindingsFeedback			Write
UpdateIPSet	guardduty:UpdateIPSet			Write
UpdateMalwareProtectionPlan	guardduty:UpdateMalwareProtectionPlan			Write
UpdateMalwareProtectionPlan	iam:PassRole	iam:PassedToService	malware-protection-plan.guardduty.amazonaws.com	Write
UpdateMalwareScanSettings	guardduty:UpdateMalwareScanSettings			Write
UpdateMemberDetectors	guardduty:UpdateMemberDetectors			Write
UpdateOrganizationConfiguration	guardduty:UpdateOrganizationConfiguration			Write
UpdatePublishingDestination	guardduty:UpdatePublishingDestination			Write
UpdateThreatEntitySet	guardduty:UpdateThreatEntitySet			Write
UpdateThreatIntelSet	guardduty:UpdateThreatIntelSet			Write
UpdateTrustedEntitySet	guardduty:UpdateTrustedEntitySet			Write

Actions defined by Amazon GuardDuty

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in Amazon. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AcceptAdministratorInvitation	Grants permission to accept invitations to become a GuardDuty member account			Write
AcceptInvitation	Grants permission to accept invitations to become a GuardDuty member account			Write
ArchiveFindings	Grants permission to archive GuardDuty findings			Write
CreateDetector	Grants permission to create a detector		aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateFilter	Grants permission to create GuardDuty filters. A filters defines finding attributes and conditions used to filter findings	filter*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateIPSet	Grants permission to create an IPSet		aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateInvestigation	Grants permission to create a GuardDuty investigation			Write
CreateMalwareProtectionPlan	Grants permission to create a new Malware Protection plan		aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateMembers	Grants permission to create GuardDuty member accounts, where the account used to create a member becomes the GuardDuty administrator account			Write
CreatePublishingDestination	Grants permission to create a publishing destination		aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateSampleFindings	Grants permission to create sample findings			Write
CreateThreatEntitySet	Grants permission to create GuardDuty ThreatEntitySets, where a ThreatEntitySet consists of known malicious IP addresses and/or domains used by GuardDuty to generate findings		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateThreatIntelSet	Grants permission to create GuardDuty ThreatIntelSets, where a ThreatIntelSet consists of known malicious IP addresses used by GuardDuty to generate findings		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateTrustedEntitySet	Grants permission to create a TrustedEntitySet		aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
DeclineInvitations	Grants permission to decline invitations to become a GuardDuty member account			Write
DeleteDetector	Grants permission to delete GuardDuty detectors	detector*	aws:ResourceTag/${TagKey}	Write
DeleteFilter	Grants permission to delete GuardDuty filters	filter*	aws:ResourceTag/${TagKey}	Write
DeleteIPSet	Grants permission to delete GuardDuty IPSets	ipset*	aws:ResourceTag/${TagKey}	Write
DeleteInvitations	Grants permission to delete invitations to become a GuardDuty member account			Write
DeleteMalwareProtectionPlan	Grants permission to delete a Malware Protection plan	malwareprotectionplan*	aws:ResourceTag/${TagKey}	Write
DeleteMembers	Grants permission to delete GuardDuty member accounts			Write
DeletePublishingDestination	Grants permission to delete a publishing destination	publishingDestination*	aws:ResourceTag/${TagKey}	Write
DeleteThreatEntitySet	Grants permission to delete GuardDuty ThreatEntitySets	threatentityset*	aws:ResourceTag/${TagKey}	Write
DeleteThreatIntelSet	Grants permission to delete GuardDuty ThreatIntelSets	threatintelset*	aws:ResourceTag/${TagKey}	Write
DeleteTrustedEntitySet	Grants permission to delete GuardDuty TrustedEntitySets	trustedentityset*	aws:ResourceTag/${TagKey}	Write
DescribeMalwareScans	Grants permission to retrieve details about malware scans			Read
DescribeOrganizationConfiguration	Grants permission to retrieve details about the delegated administrator associated with a GuardDuty detector			Read
DescribePublishingDestination	Grants permission to retrieve details about a publishing destination	publishingDestination*	aws:ResourceTag/${TagKey}	Read
DisableOrganizationAdminAccount	Grants permission to disable the organization delegated administrator for GuardDuty			Write
DisassociateFromAdministratorAccount	Grants permission to disassociate a GuardDuty member account from its GuardDuty administrator account			Write
DisassociateFromMasterAccount	Grants permission to disassociate a GuardDuty member account from its GuardDuty administrator account			Write
DisassociateMembers	Grants permission to disassociate GuardDuty member accounts from their administrator GuardDuty account			Write
EnableOrganizationAdminAccount	Grants permission to enable an organization delegated administrator for GuardDuty			Write
GetAdministratorAccount	Grants permission to retrieve details of the GuardDuty administrator account associated with a member account			Read
GetCoverageStatistics	Grants permission to list Amazon GuardDuty coverage statistics for the specified GuardDuty account in a Region	detector*	aws:ResourceTag/${TagKey}	Read
GetDetector	Grants permission to retrieve GuardDuty detectors	detector*	aws:ResourceTag/${TagKey}	Read
GetFilter	Grants permission to retrieve GuardDuty filters	filter*	aws:ResourceTag/${TagKey}	Read
GetFindings	Grants permission to retrieve GuardDuty findings			Read
GetFindingsStatistics	Grants permission to retrieve a list of GuardDuty finding statistics			Read
GetIPSet	Grants permission to retrieve GuardDuty IPSets	ipset*	aws:ResourceTag/${TagKey}	Read
GetInvestigation	Grants permission to retrieve a GuardDuty investigation			Read
GetInvitationsCount	Grants permission to retrieve the count of all GuardDuty invitations sent to a specified account, which does not include the accepted invitation			Read
GetMalwareProtectionPlan	Grants permission to retrieve a Malware Protection plan details	malwareprotectionplan*	aws:ResourceTag/${TagKey}	Read
GetMalwareScan	Grants permission to retrieve a malware scan's details			Read
GetMalwareScanSettings	Grants permission to retrieve the malware scan settings			Read
GetMasterAccount	Grants permission to retrieve details of the GuardDuty administrator account associated with a member account			Read
GetMemberDetectors	Grants permission to describe which data sources are enabled for member accounts detectors			Read
GetMembers	Grants permission to retrieve the member accounts associated with an administrator account			Read
GetOrganizationStatistics	Grants permission to retrieve GuardDuty protection plan coverage statistics for member accounts in a Region			Read
GetRemainingFreeTrialDays	Grants permission to provide the number of days left for each data source used in the free trial period			Read
GetThreatEntitySet	Grants permission to retrieve GuardDuty ThreatEntitySets	threatentityset*	aws:ResourceTag/${TagKey}	Read
GetThreatIntelSet	Grants permission to retrieve GuardDuty ThreatIntelSets	threatintelset*	aws:ResourceTag/${TagKey}	Read
GetTrustedEntitySet	Grants permission to retrieve GuardDuty TrustedEntitySets	trustedentityset*	aws:ResourceTag/${TagKey}	Read
GetUsageStatistics	Grants permission to list Amazon GuardDuty usage statistics over the last 30 days for the specified detector ID			Read
InviteMembers	Grants permission to invite other Amazon accounts to enable GuardDuty and become GuardDuty member accounts			Write
ListCoverage	Grants permission to list all the resource details for a given account in a Region	detector*	aws:ResourceTag/${TagKey}	List
ListDetectors	Grants permission to retrieve a list of GuardDuty detectors			List
ListFilters	Grants permission to retrieve a list of GuardDuty filters			List
ListFindings	Grants permission to retrieve a list of GuardDuty findings			List
ListIPSets	Grants permission to retrieve a list of GuardDuty IPSets			List
ListInvestigations	Grants permission to retrieve a list of GuardDuty investigations			List
ListInvitations	Grants permission to retrieve a list of all of the GuardDuty membership invitations that were sent to an Amazon Web Services account			List
ListMalwareProtectionPlans	Grants permission to retrieve a list of Malware Protection plans			List
ListMalwareScans	Grants permission to retrieve a list of malware scans			List
ListMembers	Grants permission to retrieve a list of GuardDuty member accounts associated with an administrator account			List
ListOrganizationAdminAccounts	Grants permission to list details about the organization delegated administrator for GuardDuty			List
ListPublishingDestinations	Grants permission to retrieve a list of publishing destinations			List
ListTagsForResource	Grants permission to retrieve a list of tags associated with a GuardDuty resource	detector	aws:ResourceTag/${TagKey}	Read
		filter	aws:ResourceTag/${TagKey}
		ipset	aws:ResourceTag/${TagKey}
		malwareprotectionplan	aws:ResourceTag/${TagKey}
		publishingDestination	aws:ResourceTag/${TagKey}
		threatentityset	aws:ResourceTag/${TagKey}
		threatintelset	aws:ResourceTag/${TagKey}
		trustedentityset	aws:ResourceTag/${TagKey}
ListThreatEntitySets	Grants permission to retrieve a list of GuardDuty ThreatEntitySets			List
ListThreatIntelSets	Grants permission to retrieve a list of GuardDuty ThreatIntelSets			List
ListTrustedEntitySets	Grants permission to retrieve a list of GuardDuty TrustedEntitySets			List
SendObjectMalwareScan	Grants permission to initiate a new object malware scan			Write
SendSecurityTelemetry	Grants permission to send security telemetry for a specific GuardDuty account in a Region			Write
StartMalwareScan	Grants permission to initiate a new malware scan			Write
StartMonitoringMembers	Grants permission to a GuardDuty administrator account to monitor findings from GuardDuty member accounts			Write
StopMonitoringMembers	Grants permission to disable monitoring findings from member accounts			Write
TagResource	Grants permission to add tags to a GuardDuty resource	detector	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		filter	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		ipset	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		malwareprotectionplan	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		publishingDestination	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		threatentityset	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		threatintelset	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		trustedentityset	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
UnarchiveFindings	Grants permission to unarchive GuardDuty findings			Write
UntagResource	Grants permission to remove tags from a GuardDuty resource	detector	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		filter	aws:ResourceTag/${TagKey} aws:TagKeys
		ipset	aws:ResourceTag/${TagKey} aws:TagKeys
		malwareprotectionplan	aws:ResourceTag/${TagKey} aws:TagKeys
		publishingDestination	aws:ResourceTag/${TagKey} aws:TagKeys
		threatentityset	aws:ResourceTag/${TagKey} aws:TagKeys
		threatintelset	aws:ResourceTag/${TagKey} aws:TagKeys
		trustedentityset	aws:ResourceTag/${TagKey} aws:TagKeys
UpdateDetector	Grants permission to update GuardDuty detectors	detector*	aws:ResourceTag/${TagKey}	Write
UpdateFilter	Grants permission to updates GuardDuty filters	filter*	aws:ResourceTag/${TagKey}	Write
UpdateFindingsFeedback	Grants permission to update findings feedback to mark GuardDuty findings as useful or not useful			Write
UpdateIPSet	Grants permission to update GuardDuty IPSets	ipset*	aws:ResourceTag/${TagKey}	Write
UpdateMalwareProtectionPlan	Grants permission to update the Malware Protection plan	malwareprotectionplan*	aws:ResourceTag/${TagKey}	Write
UpdateMalwareScanSettings	Grants permission to update the malware scan settings			Write
UpdateMemberDetectors	Grants permission to update which data sources are enabled for member accounts detectors			Write
UpdateOrganizationConfiguration	Grants permission to update the delegated administrator configuration associated with a GuardDuty detector			Write
UpdatePublishingDestination	Grants permission to update a publishing destination	publishingDestination*	aws:ResourceTag/${TagKey}	Write
UpdateThreatEntitySet	Grants permission to update GuardDuty ThreatEntitySets	threatentityset*	aws:ResourceTag/${TagKey}	Write
UpdateThreatIntelSet	Grants permission to updates the GuardDuty ThreatIntelSets	threatintelset*	aws:ResourceTag/${TagKey}	Write
UpdateTrustedEntitySet	Grants permission to update GuardDuty TrustedEntitySets	trustedentityset*	aws:ResourceTag/${TagKey}	Write

Resource types defined by Amazon GuardDuty

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
detector	arn:${Partition}:guardduty:${Region}:${Account}:detector/${DetectorId}	aws:ResourceTag/${TagKey}
filter	arn:${Partition}:guardduty:${Region}:${Account}:detector/${DetectorId}/filter/${FilterName}	aws:ResourceTag/${TagKey}
ipset	arn:${Partition}:guardduty:${Region}:${Account}:detector/${DetectorId}/ipset/${IPSetId}	aws:ResourceTag/${TagKey}
malwareprotectionplan	arn:${Partition}:guardduty:${Region}:${Account}:malware-protection-plan/${MalwareProtectionPlanId}	aws:ResourceTag/${TagKey}
publishingDestination	arn:${Partition}:guardduty:${Region}:${Account}:detector/${DetectorId}/publishingdestination/${PublishingDestinationId}	aws:ResourceTag/${TagKey}
threatentityset	arn:${Partition}:guardduty:${Region}:${Account}:detector/${DetectorId}/threatentityset/${ThreatEntitySetId}	aws:ResourceTag/${TagKey}
threatintelset	arn:${Partition}:guardduty:${Region}:${Account}:detector/${DetectorId}/threatintelset/${ThreatIntelSetId}	aws:ResourceTag/${TagKey}
trustedentityset	arn:${Partition}:guardduty:${Region}:${Account}:detector/${DetectorId}/trustedentityset/${TrustedEntitySetId}	aws:ResourceTag/${TagKey}

Condition keys for Amazon GuardDuty

Amazon GuardDuty defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by tag key-value pairs in the request	String
aws:ResourceTag/${TagKey}	Filters access by tag key-value pairs attached to the resource	String
aws:TagKeys	Filters access by tag keys in the request	ArrayOfString

Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Amazon GameLift Servers (gamelift)

Amazon Inspector2 (inspector2)