Zenn
Open2

GuardDutyのマルチアカウント周りの挙動をメモ

AWS
GuardDuty
hirogahiroga

ドキュメント
https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_organizations.html

成功のレスポンス

$ aws guardduty enable-organization-admin-account --admin-account-id $AUDIT_ACCOUNT --region ap-northeast-1

なし。また、12秒ほど待った。

すでに該当アカウントが admin account に指定されている場合のレスポンス

$ aws guardduty enable-organization-admin-account --admin-account-id $AUDIT_ACCOUNT --region us-east-1

An error occurred (BadRequestException) when calling the EnableOrganizationAdminAccount operation: The request failed because the account is already enabled as the GuardDuty delegated administrator for the organization.

すでに別のアカウントが admin accountに指定されている状態で上書きを試みる。
エラー文言が事象とどうも合わない気がするが...

$ aws guardduty enable-organization-admin-account --admin-account-id $DEV_ACCOUNT --region ap-northeast-1

An error occurred (BadRequestException) when calling the EnableOrganizationAdminAccount operation: The request failed because the account is already enabled as the GuardDuty delegated administrator for the organization.
hirogahiroga

Organizationの管理アカウントでGuardDutyが有効でないのに create-memberした場合のエラー
"Operation failed because your organization master must first enable GuardDuty to be added as a member"