GuardDuty / Client / update_organization_configuration

update_organization_configuration#

GuardDuty.Client.update_organization_configuration(**kwargs)#

Configures the delegated administrator account with the provided values. You must provide a value for either autoEnableOrganizationMembers or autoEnable, but not both.

Specifying both EKS Runtime Monitoring ( EKS_RUNTIME_MONITORING) and Runtime Monitoring ( RUNTIME_MONITORING) will cause an error. You can add only one of these two features because Runtime Monitoring already includes the threat detection for Amazon EKS resources. For more information, see Runtime Monitoring.

There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints.

Request Syntax

response = client.update_organization_configuration(
    DetectorId='string',
    AutoEnable=True|False,
    DataSources={
        'S3Logs': {
            'AutoEnable': True|False
        },
        'Kubernetes': {
            'AuditLogs': {
                'AutoEnable': True|False
            }
        },
        'MalwareProtection': {
            'ScanEc2InstanceWithFindings': {
                'EbsVolumes': {
                    'AutoEnable': True|False
                }
            }
        }
    },
    Features=[
        {
            'Name': 'S3_DATA_EVENTS'|'EKS_AUDIT_LOGS'|'EBS_MALWARE_PROTECTION'|'RDS_LOGIN_EVENTS'|'EKS_RUNTIME_MONITORING'|'LAMBDA_NETWORK_LOGS'|'RUNTIME_MONITORING',
            'AutoEnable': 'NEW'|'NONE'|'ALL',
            'AdditionalConfiguration': [
                {
                    'Name': 'EKS_ADDON_MANAGEMENT'|'ECS_FARGATE_AGENT_MANAGEMENT'|'EC2_AGENT_MANAGEMENT',
                    'AutoEnable': 'NEW'|'NONE'|'ALL'
                },
            ]
        },
    ],
    AutoEnableOrganizationMembers='NEW'|'ALL'|'NONE'
)

Parameters:

DetectorId (string) –
[REQUIRED]

The ID of the detector that configures the delegated administrator.

To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API.
AutoEnable (boolean) –
Represents whether to automatically enable member accounts in the organization. This applies to only new member accounts, not the existing member accounts. When a new account joins the organization, the chosen features will be enabled for them by default.

Even though this is still supported, we recommend using AutoEnableOrganizationMembers to achieve the similar results. You must provide a value for either autoEnableOrganizationMembers or autoEnable.
DataSources (dict) –
Describes which data sources will be updated.
- S3Logs (dict) –
  
  Describes whether S3 data event logs are enabled for new members of the organization.
  - AutoEnable (boolean) – [REQUIRED]
    
    A value that contains information on whether S3 data event logs will be enabled automatically as a data source for the organization.
- Kubernetes (dict) –
  
  Describes the configuration of Kubernetes data sources for new members of the organization.
  - AuditLogs (dict) – [REQUIRED]
    
    Whether Kubernetes audit logs data source should be auto-enabled for new members joining the organization.
    - AutoEnable (boolean) – [REQUIRED]
      
      A value that contains information on whether Kubernetes audit logs should be enabled automatically as a data source for the organization.
- MalwareProtection (dict) –
  
  Describes the configuration of Malware Protection for new members of the organization.
  - ScanEc2InstanceWithFindings (dict) –
    
    Whether Malware Protection for EC2 instances with findings should be auto-enabled for new members joining the organization.
    - EbsVolumes (dict) –
      
      Whether scanning EBS volumes should be auto-enabled for new members joining the organization.
      - AutoEnable (boolean) –
        
        Whether scanning EBS volumes should be auto-enabled for new members joining the organization.
Features (list) –
A list of features that will be configured for the organization.
- (dict) –
  
  A list of features which will be configured for the organization.
  - Name (string) –
    
    The name of the feature that will be configured for the organization.
  - AutoEnable (string) –
    
    Describes the status of the feature that is configured for the member accounts within the organization. One of the following values is the status for the entire organization:
    - NEW: Indicates that when a new account joins the organization, they will have the feature enabled automatically.
    - ALL: Indicates that all accounts in the organization have the feature enabled automatically. This includes NEW accounts that join the organization and accounts that may have been suspended or removed from the organization in GuardDuty. It may take up to 24 hours to update the configuration for all the member accounts.
    - NONE: Indicates that the feature will not be automatically enabled for any account in the organization. The administrator must manage the feature for each account individually.
  - AdditionalConfiguration (list) –
    
    The additional information that will be configured for the organization.
    - (dict) –
      
      A list of additional configurations which will be configured for the organization.
      
      Additional configuration applies to only GuardDuty Runtime Monitoring protection plan.
      - Name (string) –
        
        The name of the additional configuration that will be configured for the organization. These values are applicable to only Runtime Monitoring protection plan.
      - AutoEnable (string) –
        
        The status of the additional configuration that will be configured for the organization. Use one of the following values to configure the feature status for the entire organization:
        
        NEW: Indicates that when a new account joins the organization, they will have the additional configuration enabled automatically.
        
        ALL: Indicates that all accounts in the organization have the additional configuration enabled automatically. This includes NEW accounts that join the organization and accounts that may have been suspended or removed from the organization in GuardDuty. It may take up to 24 hours to update the configuration for all the member accounts.
        
        NONE: Indicates that the additional configuration will not be automatically enabled for any account in the organization. The administrator must manage the additional configuration for each account individually.
AutoEnableOrganizationMembers (string) –
Indicates the auto-enablement configuration of GuardDuty for the member accounts in the organization. You must provide a value for either autoEnableOrganizationMembers or autoEnable.

Use one of the following configuration values for autoEnableOrganizationMembers:
- NEW: Indicates that when a new account joins the organization, they will have GuardDuty enabled automatically.
- ALL: Indicates that all accounts in the organization have GuardDuty enabled automatically. This includes NEW accounts that join the organization and accounts that may have been suspended or removed from the organization in GuardDuty. It may take up to 24 hours to update the configuration for all the member accounts.
- NONE: Indicates that GuardDuty will not be automatically enabled for any account in the organization. The administrator must manage GuardDuty for each account in the organization individually. When you update the auto-enable setting from ALL or NEW to NONE, this action doesn’t disable the corresponding option for your existing accounts. This configuration will apply to the new accounts that join the organization. After you update the auto-enable settings, no new account will have the corresponding option as enabled.

Return type:

dict

Returns:

Response Syntax

{}

Response Structure

(dict) –

Exceptions

GuardDuty.Client.exceptions.BadRequestException
GuardDuty.Client.exceptions.InternalServerErrorException