[AWS][CFn]GuardDuty 설정

샘플 코드

---
AWSTemplateFormatVersion: 2010-09-09
Description: GuardDuty

#------------------------------
# Parameters: Your resource list
#------------------------------
Parameters:
  EMailAddress: # スタック作成時に任意のメールアドレスを指定してください。
    Type: String
    Description: Specifies your E-Mail for notify GuardDutyAlert.

#------------------------------
# Resources: Your resource list
#------------------------------
Resources:
  # GuardDutyを有効にする
  GuardDuty:
    Type: AWS::GuardDuty::Detector
    Properties:
      Enable: true

  # SNSを作成する（今回はメール通知）
  ## Topic
  SNSTopic:
    Type: AWS::SNS::Topic
    Properties:
      TopicName: GuardDutyTopic #任意の名前に変更してください
      Subscription:
      - Endpoint: !Ref EMailAddress
        Protocol: email

  ## Topic Policy
  SNSTopicPolicy:
    Type: AWS::SNS::TopicPolicy
    Properties:
      PolicyDocument:
        Id: default_policy_ID
        Version: 2012-10-17
        Statement:
        - Sid: default_statement_ID
          Effect: Allow
          Principal:
            AWS: "*"
          Action:
          - SNS:GetTopicAttributes
          - SNS:SetTopicAttributes
          - SNS:AddPermission
          - SNS:RemovePermission
          - SNS:DeleteTopic
          - SNS:Subscribe
          - SNS:ListSubscriptionsByTopic
          - SNS:Publish
          - SNS:Receive
          Resource: !Ref SNSTopic
          Condition:
            StringEquals:
              AWS:SourceOwner: !Ref AWS::AccountId
        - Sid: AWSEvents_AlertGuardDutyFindings_Id123
          Effect: Allow
          Principal:
            Service:
            - events.amazonaws.com
          Action: sns:Publish
          Resource: !Ref SNSTopic
      Topics:
      - !Ref SNSTopic

  # GuardDutyでイベントを検知した時にCloudwatchイベントを使用してSNSに通知する
  ## Cloudwatch Rule for GuardDuty
  GuardDutyCWEventRule:
    Type: AWS::Events::Rule
    Properties:
      Name: AlertGuardDutyFindings
      Description: Alert to SNS topic when find threats by GuardDuty
      EventPattern: {
                      "source": [
                        "aws.guardduty"
                      ],
                      "detail-type": [
                        "GuardDuty Finding"
                      ]
                    }
      Targets:
      - Arn: !Ref SNSTopic
        Id: Id123

실행 결과