organization_configurations

Creates, updates, deletes, gets or lists an organization_configurations resource.

Overview

Name	organization_configurations
Type	Resource
Id	aws.guardduty.organization_configurations

Fields

The following fields are returned by SELECT queries:

describe_organization_configuration

Name	Datatype	Description
auto_enable	boolean	Indicates whether GuardDuty is automatically enabled for accounts added to the organization. Even though this is still supported, we recommend using AutoEnableOrganizationMembers to achieve the similar results.
auto_enable_organization_members	string	Indicates the auto-enablement configuration of GuardDuty or any of the corresponding protection plans for the member accounts in the organization. NEW: Indicates that when a new account joins the organization, they will have GuardDuty or any of the corresponding protection plans enabled automatically. ALL: Indicates that all accounts in the organization have GuardDuty and any of the corresponding protection plans enabled automatically. This includes NEW accounts that join the organization and accounts that may have been suspended or removed from the organization in GuardDuty. NONE: Indicates that GuardDuty or any of the corresponding protection plans will not be automatically enabled for any account in the organization. The administrator must manage GuardDuty for each account in the organization individually. When you update the auto-enable setting from ALL or NEW to NONE, this action doesn't disable the corresponding option for your existing accounts. This configuration will apply to the new accounts that join the organization. After you update the auto-enable settings, no new account will have the corresponding option as enabled. (NEW, ALL, NONE)
data_sources	object	Describes which data sources are enabled automatically for member accounts.
features	array	A list of features that are configured for this organization.
member_account_limit_reached	boolean	Indicates whether the maximum number of allowed member accounts are already associated with the delegated administrator account for your organization.
next_token	string	The pagination parameter to be used on the next list operation to retrieve more items.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
describe_organization_configuration	select	detector_id, region	maxResults, nextToken	Returns information about the account selected as the delegated administrator for GuardDuty. There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints.
update_organization_configuration	update	detector_id, region		Configures the delegated administrator account with the provided values. You must provide a value for either autoEnableOrganizationMembers or autoEnable, but not both. Specifying both EKS Runtime Monitoring (EKS_RUNTIME_MONITORING) and Runtime Monitoring (RUNTIME_MONITORING) will cause an error. You can add only one of these two features because Runtime Monitoring already includes the threat detection for Amazon EKS resources. For more information, see Runtime Monitoring. There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
detector_id	string	The ID of the detector that configures the delegated administrator. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API.
region	string	AWS region (default: us-east-1)
maxResults	integer	You can use this parameter to indicate the maximum number of items that you want in the response.
nextToken	string	You can use this parameter when paginating results. Set the value of this parameter to null on your first call to the list action. For subsequent calls to the action, fill nextToken in the request with the value of NextToken from the previous response to continue listing data.

SELECT examples

describe_organization_configuration

Returns information about the account selected as the delegated administrator for GuardDuty. There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints.

SELECT
auto_enable,
auto_enable_organization_members,
data_sources,
features,
member_account_limit_reached,
next_token
FROM aws.guardduty.organization_configurations
WHERE detector_id = '{{ detector_id }}' -- required
AND region = '{{ region }}' -- required
AND maxResults = '{{ maxResults }}'
AND nextToken = '{{ nextToken }}'
;

UPDATE examples

update_organization_configuration

Configures the delegated administrator account with the provided values. You must provide a value for either autoEnableOrganizationMembers or autoEnable, but not both. Specifying both EKS Runtime Monitoring (EKS_RUNTIME_MONITORING) and Runtime Monitoring (RUNTIME_MONITORING) will cause an error. You can add only one of these two features because Runtime Monitoring already includes the threat detection for Amazon EKS resources. For more information, see Runtime Monitoring. There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints.

UPDATE aws.guardduty.organization_configurations
SET 
AutoEnable = {{ AutoEnable }},
DataSources = '{{ DataSources }}',
Features = '{{ Features }}',
AutoEnableOrganizationMembers = '{{ AutoEnableOrganizationMembers }}'
WHERE 
detector_id = '{{ detector_id }}' --required
AND region = '{{ region }}' --required;