GuardDuty S3 protection enable/disable

[pietro]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

Amazon added S3 protection in GuardDuty. This is enabled by default when new detectors are created and has to be manually disabled if a user doesn't want S3 protection and its associated costs. Conversely users of detectors that were created before the feature roll out need to manually enable if they want the feature.

New or Affected Resource(s)

• aws_guardduty_detector

Potential Terraform Configuration

resource "aws_guardduty_detector" "current" {
  enable = true
}

resource "aws_guardduty_detector" "with-s3-protection" {
  enable = true
  enable_s3_protection = true
}

resource "aws_guardduty_detector" "without-s3-protection" {
  enable = true
  enable_s3_protection = false
}

References

• https://aws.amazon.com/blogs/aws/new-using-amazon-guardduty-to-protect-your-s3-buckets/
• https://docs.aws.amazon.com/guardduty/latest/ug/s3_detection.html
• https://docs.aws.amazon.com/guardduty/latest/APIReference/API_CreateDetector.html
• https://docs.aws.amazon.com/guardduty/latest/APIReference/API_UpdateDetector.html

[ewbankkit]

@pietro Thanks for raising this issue.
It has already been noticed in #14607. I'm going to close this one as a duplicate so that we can concentrate discussion in the linked issue.
Please add any additional comments there.

[pietro]

Thanks @ewbankkit, I didn't see the other ticket in my search.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!