GuardDuty with cloudwatch event and sns topic.

main.tf

@@ -81,6 +81,8 @@ module "sns" {
   source = "./modules/sns"
   sns_phone_number  = var.sns_phone_number
   sns_email_address = var.sns_email_address
+  sns_phone_number_guard = var.sns_phone_number_guard
+  sns_email_address_guard = var.sns_email_address_guard
 }
 
 # Cloudwatch monitoring
@@ -92,6 +94,7 @@ module "cloudwatch_alarm" {
   source = "./modules/cloudwatch"
   instance-id   = each.value
   sns_topic-arn = module.sns.sns_topic-arn
+  sns_topic-arn-guardduty = module.sns.sns_topic-arn-guardduty
   instance-name = each.key
 }
 
@@ -108,3 +111,7 @@ module "eks" {
   vpc_cidr_eks = var.vpc_cidr_eks
   subnet_cidr_bits_eks = var.subnet_cidr_bits_eks
 }
+
+module "GuardDuty" {
+  source = "./modules/GuardDuty"
+}

modules/GuardDuty/main.tf

@@ -0,0 +1,5 @@
+# Enable GuardDuty option is 'ONE_HOUR' or 'SIX_HOURS' or 'FIFTEEN_MINUTES'
+resource "aws_guardduty_detector" "primary" {
+  enable = true
+  finding_publishing_frequency = "SIX_HOURS"
+}

modules/cloudwatch/main.tf

@@ -28,4 +28,37 @@ resource "aws_cloudwatch_metric_alarm" "status_check_failed" {
     }
     statistic     = "SampleCount"
     threshold     = "0.99"
+}
+
+#Create CloudWatch Event Rule triggered by GuardDuty finding
+resource "aws_cloudwatch_event_rule" "guardduty_finding" {
+  name        = "guardduty-finding"
+  description = "GuardDuty finding"
+
+  event_pattern = <<EOF
+{
+  "source": [
+    "aws.guardduty"
+  ],
+  "detail-type": [
+    "GuardDuty Finding"
+  ]
+}
+EOF
+}
+
+# CloudWatch Event target that sends GuardDuty findings to an SNS topic
+resource "aws_cloudwatch_event_target" "send_to_sns" {
+  rule      = aws_cloudwatch_event_rule.guardduty_finding.name
+  target_id = "SendToSNS"
+  arn       = var.sns_topic-arn-guardduty
+
+  input_transformer {
+    input_paths = {
+      instance = "$.detail.resource.instanceDetails.instanceId",
+      state = "$.detail.service.action.networkConnectionAction.connectionDirection"
+    }
+
+    input_template = "\"GuardDuty finding for instance: <instance>, State: <state>\""
+  }
 }

modules/cloudwatch/variables.tf

@@ -8,4 +8,8 @@ variable "instance-name" {
 
 variable "sns_topic-arn" {
   description = "ARN of the SNS topic"
-}
+}
+
+variable "sns_topic-arn-guardduty" {
+  description = "ARN of the SNS topic for GuardDuty alerts"
+}

modules/sns/main.tf

@@ -2,6 +2,11 @@ resource "aws_sns_topic" "topic_ec2" {
     name = "ec2-down-topic"
 }
 
+#create a SNS topic for GuardDuty alerts
+resource "aws_sns_topic" "guardduty_alerts" {
+  name = "guardduty-alerts"
+}
+
 resource "aws_sns_topic_subscription" "sms_subscription" {
     topic_arn = aws_sns_topic.topic_ec2.arn
     protocol  = "sms"
@@ -12,4 +17,16 @@ resource "aws_sns_topic_subscription" "email_subscription" {
     topic_arn = aws_sns_topic.topic_ec2.arn
     protocol  = "email"
     endpoint  = var.sns_email_address
+}
+
+resource "aws_sns_topic_subscription" "email_subscription_guardduty" {
+  topic_arn = aws_sns_topic.guardduty_alerts.arn
+  protocol  = "email"
+  endpoint  = var.sns_email_address_guard
+}
+
+resource "aws_sns_topic_subscription" "sms_subscription_guardduty" {
+  topic_arn = aws_sns_topic.guardduty_alerts.arn
+  protocol  = "sms"
+  endpoint  = var.sns_phone_number_guard
 }

modules/sns/output.tf

@@ -1,4 +1,9 @@
 output "sns_topic-arn" {
     description = "ARN of the SNS topic"
     value = aws_sns_topic.topic_ec2.arn
+}
+
+output "sns_topic-arn-guardduty" {
+    description = "ARN of the SNS topic for GuardDuty alerts"
+    value = aws_sns_topic.guardduty_alerts.arn
 }

modules/sns/variables.tf

@@ -4,4 +4,12 @@ variable "sns_phone_number" {
 
 variable "sns_email_address" {
   description = "Email address for Email Alerts"
+}
+
+variable "sns_phone_number_guard" {
+  description = "Phone number for SMS Alerts"
+}
+
+variable "sns_email_address_guard" {
+  description = "Email address for Email Alerts"
 }

variables.tf

@@ -247,6 +247,14 @@ variable "sns_email_address" {
   description = "Email address for Email Alerts"
 }
 
+variable "sns_phone_number_guard" {
+  description = "Phone number for SMS Alerts"
+}
+
+variable "sns_email_address_guard" {
+  description = "Email address for Email Alerts"
+}
+
 variable "mysql_host" {
   description = "MySQL Host"
   type        = string