Skip to content

Instantly share code, notes, and snippets.

@coingraham

coingraham/guard-duty-custodian.yaml

Created February 5, 2020 19:51
Show Gist options
  • Save coingraham/b8ff7ea0a43041750254d11eba2e9d76 to your computer and use it in GitHub Desktop.
Save coingraham/b8ff7ea0a43041750254d11eba2e9d76 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. coingraham created this gist Feb 5, 2020.
    28 changes: 28 additions & 0 deletions guard-duty-custodian.yaml
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,28 @@
    policies:

    - name: ec2-guard-remediate
    resource: ec2
    mode:
    role: arn:aws:iam::{account_id}:role/CustodianPolicyExecution
    type: guard-duty
    filters:
    # Filter for medium and high severity events
    - type: event
    key: detail.severity
    op: gte
    value: 4.5
    actions:
    - stop

    - name: iam-guard-remediate
    resource: iam-user
    mode:
    role: arn:aws:iam::{account_id}:role/CustodianPolicyExecution
    type: guard-duty
    filters:
    # Only a particular type of event, go ahead and remove keys
    - type: event
    key: detail.type
    value: "UnauthorizedAccess:IAMUser/TorIPCaller"
    actions:
    - remove-keys