aws-gd-explicit-disassociate-from-admin
Principal holds effective IAM permission to disassociate from GuardDuty delegated administrator (member account action).
match (effective permission)
{
"action": "guardduty:DisassociateFromAdministratorAccount",
"resource_arn_pattern": "arn:aws:guardduty:*:*:detector/*",
"resource_type": "AWS::GuardDuty::Detector"
}
emit
| source type | Identity |
|---|---|
| target type | SecurityService |
| source | <principal> |
| target | <detector> |
| permissions | guardduty:DisassociateFromAdministratorAccount |
| conditions | iam_permission |
Narrative
{principal.name} holds effective permission to sever {detector.name}'s connection to the GuardDuty Organizations delegated administrator.
Raw rule rules/explicit/aws-guardduty.yaml
id: aws-gd-explicit-disassociate-from-admin
emits: HasPermission
description: Principal holds effective IAM permission to disassociate from GuardDuty delegated administrator
(member account action).
match_effective_permission:
action: guardduty:DisassociateFromAdministratorAccount
resource_type: AWS::GuardDuty::Detector
resource_arn_pattern: arn:aws:guardduty:*:*:detector/*
emit:
source_type: Identity
target_type: SecurityService
source: <principal>
target: <detector>
permissions:
- guardduty:DisassociateFromAdministratorAccount
conditions:
- iam_permission
narrative: '{principal.name} holds effective permission to sever {detector.name}''s connection to the
GuardDuty Organizations delegated administrator.'