guardduty.yaml

AWSTemplateFormatVersion: 2010-09-09
Transform: AWS::Serverless-2016-10-31
Description: Sets up GuardDuty with a delegated administor and automatically enabled for all AWS accounts in the AWS Organization

Resources:

  LandingZoneSetupFinishedTrigger:
    Type: AWS::Events::Rule
    Properties:
      EventPattern:
        source:
          - superwerker
        detail:
          eventName:
            - LandingZoneSetupOrUpdateFinished
      State: ENABLED
      Targets:
        - Arn: !Sub arn:${AWS::Partition}:ssm:${AWS::Region}:${AWS::AccountId}:automation-definition/${EnableGuardDutyOrganizations}
          Id: EnableGuardDutyOrganizations
          RoleArn: !GetAtt SSMAutomationExecutionRoleforCWEvents.Arn

  SSMAutomationExecutionRoleforCWEvents:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service: events.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: AllowStartAutomationExecution
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - ssm:StartAutomationExecution
                Resource: !Sub arn:${AWS::Partition}:ssm:${AWS::Region}:${AWS::AccountId}:automation-definition/${EnableGuardDutyOrganizations}:*

  EnableGuardDutyOrganizations:
    Type: AWS::SSM::Document
    Properties:
      DocumentType: Automation
      Content:
        schemaVersion: '0.3'
        assumeRole: !GetAtt EnableGuardDutyOrganizationsRole.Arn
        parameters:
          AuditAccountId:
            type: String
            default: '{{ssm:/superwerker/account_id_audit}}'
          LogArchiveAccountId:
            type: String
            default: '{{ssm:/superwerker/account_id_logarchive}}'
        mainSteps:
          - name: CheckIfOrganizationAdminAccountIsAlReadyRegistered
            action: aws:executeAwsApi
            inputs:
              Service: guardduty
              Api: ListOrganizationAdminAccounts
            outputs:
              - Name: AdminAccountId
                Selector: $.AdminAccounts[0].AdminAccountId
            nextStep: EnableOrganizationAdminAccountChoice
          - name: EnableOrganizationAdminAccountChoice
            action: aws:branch
            inputs:
              Choices:
                - NextStep: EnableGuardDutyInMaster
                  Variable: '{{ CheckIfOrganizationAdminAccountIsAlReadyRegistered.AdminAccountId }}'
                  StringEquals: '{{ AuditAccountId }}'
              Default: EnableOrganizationAdminAccount
          - name: EnableOrganizationAdminAccount
            action: aws:executeAwsApi
            inputs:
              Service: guardduty
              Api: EnableOrganizationAdminAccount
              AdminAccountId: '{{ AuditAccountId }}'
            nextStep: EnableGuardDutyInMaster
          - name: EnableGuardDutyInMaster
            action: aws:executeAwsApi
            inputs:
              Service: guardduty
              Api: CreateDetector
              Enable: true
            nextStep: EnableGuardDutyExistingAccounts
          - name: EnableGuardDutyExistingAccounts
            action: aws:executeAwsApi
            inputs:
              Service: ssm
              Api: StartAutomationExecution
              DocumentName: !Ref EnableGuardDutyExistingAccounts
              TargetLocations:
                - ExecutionRoleName: AWSControlTowerExecution
                  Accounts:
                    - '{{ AuditAccountId }}'
                  Regions:
                    - !Ref AWS::Region
              Parameters:
                LogArchiveAWSAccountId:
                  - '{{ LogArchiveAccountId }}'
                MasterAWSAccountId:
                  - !Ref AWS::AccountId
            outputs:
              - Name: AutomationExecutionId
                Selector: $.AutomationExecutionId
            nextStep: WaitForEnableGuardDutyExistingAccounts
          - name: WaitForEnableGuardDutyExistingAccounts
            timeoutSeconds: 60
            action: aws:waitForAwsResourceProperty
            inputs:
              Service: ssm
              Api: DescribeAutomationExecutions
              Filters:
                - Key: ExecutionId
                  Values:
                    - '{{ EnableGuardDutyExistingAccounts.AutomationExecutionId }}'
              PropertySelector: $.AutomationExecutionMetadataList[0].AutomationExecutionStatus
              DesiredValues:
                - Success

  EnableGuardDutyOrganizationsRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service: ssm.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: EnableAWSServiceAccess
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - guardduty:EnableOrganizationAdminAccount
                  - guardduty:ListOrganizationAdminAccounts
                  - guardduty:CreateDetector
                  - organizations:EnableAWSServiceAccess
                  - organizations:ListAWSServiceAccessForOrganization
                  - organizations:ListDelegatedAdministrators
                  - organizations:RegisterDelegatedAdministrator
                  - organizations:DescribeOrganization
                  - ssm:DescribeAutomationExecutions
                Resource: '*'
        - PolicyName: AllowStartAutomationExecution
          PolicyDocument:
            Statement:
                - Effect: Allow
                  Action: ssm:StartAutomationExecution
                  Resource: !Sub arn:${AWS::Partition}:ssm:${AWS::Region}:${AWS::AccountId}:automation-definition/${EnableGuardDutyExistingAccounts}:*
        - PolicyName: AllowCallCrossAccountAutomation
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action: sts:AssumeRole
                Resource: arn:aws:iam::*:role/AWSControlTowerExecution
        - PolicyName: SSMParameters
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action: ssm:GetParameters
                Resource: !Sub arn:${AWS::Partition}:ssm:${AWS::Region}:${AWS::AccountId}:parameter/superwerker/*
        - PolicyName: ServiceLinkedRole
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action: iam:CreateServiceLinkedRole
                Resource: !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:role/aws-service-role/guardduty.amazonaws.com/AWSServiceRoleForAmazonGuardDuty

  EnableGuardDutyExistingAccounts:
    Type: AWS::SSM::Document
    Properties:
      DocumentType: Automation
      Content:
        schemaVersion: '0.3'
        parameters:
          LogArchiveAWSAccountId:
            type: String
          MasterAWSAccountId:
            type: String
        mainSteps:
          - name: GetDetectorId
            action: aws:executeAwsApi
            inputs:
              Service: guardduty
              Api: ListDetectors
            outputs:
              - Name: DetectorId
                Selector: $.DetectorIds[0]
          - name: MasterAWSAccount
            action: aws:executeAwsApi
            inputs:
              Service: organizations
              Api: DescribeAccount
              AccountId: '{{ MasterAWSAccountId }}'
            outputs:
              - Name: EmailAddress
                Selector: $.Account.Email
          - name: LogArchiveAWSAccount
            action: aws:executeAwsApi
            inputs:
              Service: organizations
              Api: DescribeAccount
              AccountId: '{{ LogArchiveAWSAccountId }}'
            outputs:
              - Name: EmailAddress
                Selector: $.Account.Email
          - name: CreateMembers
            action: aws:executeAwsApi
            inputs:
              Service: guardduty
              Api: CreateMembers
              DetectorId: '{{ GetDetectorId.DetectorId }}'
              AccountDetails:
                - AccountId: '{{ MasterAWSAccountId }}'
                  Email: '{{ MasterAWSAccount.EmailAddress }}'
                - AccountId: '{{ LogArchiveAWSAccountId }}'
                  Email: '{{ LogArchiveAWSAccount.EmailAddress }}'
          - name: EnableGuardDutyExistingAccounts
            action: aws:executeAwsApi
            inputs:
              Service: guardduty
              Api: UpdateOrganizationConfiguration
              DetectorId: '{{ GetDetectorId.DetectorId }}'
              AutoEnable: true