Managing accounts using organization policies - Amazon GuardDuty
Prerequisites
Services or capabilities described in AWS documentation might vary by Region. To see the differences applicable to the AWS European Sovereign Cloud Region, see the AWS European Sovereign Cloud User Guide.

Managing accounts using organization policies

A GuardDuty organization policy lets you centrally enable and manage Amazon GuardDuty across the accounts in your organization. You use an AWS Organizations declarative policy to specify which organizational entities (the organization root, organizational units (OUs), or individual accounts) have the GuardDuty foundational detector and its protection plans automatically enabled and managed through the delegated GuardDuty administrator account. Accounts that join the organization, or move into an OU that has an attached policy, inherit the policy and have GuardDuty and its protection plans configured according to what the effective policy defines for them.

GuardDuty organization policies are a different mechanism from the auto-enable settings described in Managing GuardDuty accounts with AWS Organizations. For the policy concept, structure, inheritance, validation, and example policies, see GuardDuty policies in the AWS Organizations User Guide.

Contents

Prerequisites

Before you use GuardDuty organization policies, complete the following prerequisites:

  • Enable trusted access for the GuardDuty service in AWS Organizations.

  • Assign a delegated GuardDuty administrator account.

  • Attach the delegation policy that grants the delegated administrator permission to manage GuardDuty policies.

  • Enable the GUARDDUTY_POLICY policy type on the organization root. This happens automatically when the delegated administrator creates the first policy in the GuardDuty console.

Warning

Enabling the GUARDDUTY_POLICY policy type stops the Regional GuardDuty auto-enablement settings from applying, even before you attach a policy. Because the console enables this policy type automatically when the delegated administrator creates the first policy, you can stop relying on auto-enablement without intending to. Review your existing auto-enablement configuration before you create your first policy.

For the detailed steps, see GuardDuty policies in the AWS Organizations User Guide.