Amazon GuardDuty now supports centralized management using AWS Organizations declarative policies
Amazon GuardDuty supports AWS Organizations declarative policies, enabling centralized threat detection across all accounts and Regions in your AWS organization. The configuration applies to existing accounts and is automatically maintained as new accounts join your organization.
Amazon GuardDuty now supports declarative policies in AWS Organizations, enabling centralized threat detection across all accounts and regions in an organization. Organization policies let you apply centralized GuardDuty activation settings that automatically apply to existing accounts and new accounts as they join. This eliminates the need to configure GuardDuty activation individually per region in large multi-account, multi-region environments, ensuring settings remain consistent over time. You can define activation criteria for the entire organization from a delegated administrator account, at the organization root, OU, or individual account level. Policies apply default settings in all available GuardDuty regions and support region-specific overrides, but cannot be overridden via the GuardDuty console or API. Support for GuardDuty declarative policies is available in all AWS commercial regions and AWS GovCloud (US). Ensure the delegated administrator has permissions to manage GuardDuty policies, then sign in to the GuardDuty console and select Organization policies, or create policies programmatically using the AWS Organizations API.
Why it matters
This update is useful for organizations managing multiple AWS accounts and Regions, as it allows for centralized and consistent threat detection configuration.