IAM / security / guardduty

Amazon GuardDuty (IAM)

JSON →
AWSguarddutysecurity

Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior.

iamaws
docs ↗
Permissions
Actions in this service
guardduty:ListDetectors
guardduty:GetDetector
guardduty:ListFindings
guardduty:GetFindings
guardduty:ListFilters
guardduty:GetFilter
guardduty:ListIPSets
guardduty:GetIPSet
Policy
Minimal privilege example

Copy-paste least-privilege policy statement — not yet harness-verified.

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "guardduty:ListDetectors", "guardduty:GetDetector", "guardduty:ListFindings", "guardduty:GetFindings", "guardduty:ListFilters", "guardduty:GetFilter", "guardduty:ListIPSets", "guardduty:GetIPSet" ], "Resource": "*" } ] }
SDK mapping
Method → permission

SDK method mapping (e.g. boto3.get_object() → s3:GetObject) is not yet collected.

Footguns
Known gotchas
Avoid guardduty:* — grants full control including detector deletion and configuration changes
Avoid guardduty:DeleteDetector and guardduty:DeleteIPSet — can disable threat detection and remove critical threat intelligence
Resources
docshttps://servicereference.us-east-1.amazonaws.com/v1/guardduty/guardduty.json ↗