Aws/guardduty

@swamp/aws/guarddutyv2026.09.21.1· 1d agoMODELS

01README

AWS GUARDDUTY infrastructure models

02Models11

@swamp/aws/guardduty/custom-detection-rule-associationv2026.08.24.1custom_detection_rule_association.ts

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
RuleId	string	yes	The catalog identifier of the custom detection rule to associate.
Mode	enum	yes	Whether the rule runs in LIVE mode (generates findings) or DRY_RUN mode (evaluates without generating findings).
Tags?	array	no	The tags applied to the association.

fn create()

Create a GuardDuty CustomDetectionRuleAssociation

fn get(identifier: string)

Get a GuardDuty CustomDetectionRuleAssociation

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the GuardDuty CustomDetectionRuleAssociation

fn update()

Update a GuardDuty CustomDetectionRuleAssociation

fn delete(identifier: string)

Delete a GuardDuty CustomDetectionRuleAssociation

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the GuardDuty CustomDetectionRuleAssociation

fn sync()

Sync GuardDuty CustomDetectionRuleAssociation state from AWS

fn list(maxPages?: number, resourceModel?: string)

List GuardDuty CustomDetectionRuleAssociation resources

Argument	Type	Required	Description
maxPages?	number	no	Maximum number of pages to fetch (default: 10)
resourceModel?	string	no	JSON resource model for parent-scoped listing (e.g. parent identifier)

Resources

state(infinite)— GuardDuty CustomDetectionRuleAssociation resource state

@swamp/aws/guardduty/detectorv2026.08.17.2detector.ts

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
FindingPublishingFrequency?	string	no
Enable	boolean	yes
DataSources?	object	no
Features?	array	no
Tags?	array	no

fn create()

Create a GuardDuty Detector

fn get(identifier: string)

Get a GuardDuty Detector

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the GuardDuty Detector

fn update()

Update a GuardDuty Detector

fn delete(identifier: string)

Delete a GuardDuty Detector

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the GuardDuty Detector

fn sync()

Sync GuardDuty Detector state from AWS

fn list(maxPages?: number, resourceModel?: string)

List GuardDuty Detector resources

Argument	Type	Required	Description
maxPages?	number	no	Maximum number of pages to fetch (default: 10)
resourceModel?	string	no	JSON resource model for parent-scoped listing (e.g. parent identifier)

Resources

state(infinite)— GuardDuty Detector resource state

@swamp/aws/guardduty/filterv2026.08.30.1filter.ts

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
Action?	string	no
Description?	string	no
DetectorId	string	yes
FindingCriteria	object	yes
Rank?	number	no
Name	string	yes
Tags?	array	no

fn create()

Create a GuardDuty Filter

fn get(identifier: string)

Get a GuardDuty Filter

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the GuardDuty Filter

fn update()

Update a GuardDuty Filter

fn delete(identifier: string)

Delete a GuardDuty Filter

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the GuardDuty Filter

fn sync()

Sync GuardDuty Filter state from AWS

fn list(maxPages?: number, resourceModel?: string)

List GuardDuty Filter resources

Argument	Type	Required	Description
maxPages?	number	no	Maximum number of pages to fetch (default: 10)
resourceModel?	string	no	JSON resource model for parent-scoped listing (e.g. parent identifier)

Resources

state(infinite)— GuardDuty Filter resource state

@swamp/aws/guardduty/ipsetv2026.08.17.2ipset.ts

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
Format	string	yes
Activate?	boolean	no
DetectorId?	string	no
Name?	string	no
Location	string	yes
ExpectedBucketOwner?	string	no
Tags?	array	no

fn create()

Create a GuardDuty IPSet

fn get(identifier: string)

Get a GuardDuty IPSet

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the GuardDuty IPSet

fn update()

Update a GuardDuty IPSet

fn delete(identifier: string)

Delete a GuardDuty IPSet

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the GuardDuty IPSet

fn sync()

Sync GuardDuty IPSet state from AWS

fn list(maxPages?: number, resourceModel?: string)

List GuardDuty IPSet resources

Argument	Type	Required	Description
maxPages?	number	no	Maximum number of pages to fetch (default: 10)
resourceModel?	string	no	JSON resource model for parent-scoped listing (e.g. parent identifier)

Resources

state(infinite)— GuardDuty IPSet resource state

@swamp/aws/guardduty/malware-protection-planv2026.08.17.2malware_protection_plan.ts

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
Role	string	yes	IAM role that includes the permissions required to scan and (optionally) add tags to the associated protected resource.
ProtectedResource	object	yes	Information about the protected resource. Presently, S3Bucket is the only supported protected resource.
Tags?	array	no	The tags to be added to the created Malware Protection plan resource. Each tag consists of a key and an optional value, both of which you need to specify.

fn create()

Create a GuardDuty MalwareProtectionPlan

fn get(identifier: string)

Get a GuardDuty MalwareProtectionPlan

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the GuardDuty MalwareProtectionPlan

fn update()

Update a GuardDuty MalwareProtectionPlan

fn delete(identifier: string)

Delete a GuardDuty MalwareProtectionPlan

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the GuardDuty MalwareProtectionPlan

fn sync()

Sync GuardDuty MalwareProtectionPlan state from AWS

fn list(maxPages?: number, resourceModel?: string)

List GuardDuty MalwareProtectionPlan resources

Argument	Type	Required	Description
maxPages?	number	no	Maximum number of pages to fetch (default: 10)
resourceModel?	string	no	JSON resource model for parent-scoped listing (e.g. parent identifier)

Resources

state(infinite)— GuardDuty MalwareProtectionPlan resource state

@swamp/aws/guardduty/masterv2026.08.17.2master.ts

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
MasterId	string	yes	ID of the account used as the master account.
InvitationId?	string	no	Value used to validate the master account to the member account.
DetectorId	string	yes	Unique ID of the detector of the GuardDuty member account.

fn create()

Create a GuardDuty Master

fn get(identifier: string)

Get a GuardDuty Master

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the GuardDuty Master

fn delete(identifier: string)

Delete a GuardDuty Master

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the GuardDuty Master

fn sync()

Sync GuardDuty Master state from AWS

fn list(maxPages?: number, resourceModel?: string)

List GuardDuty Master resources

Argument	Type	Required	Description
maxPages?	number	no	Maximum number of pages to fetch (default: 10)
resourceModel?	string	no	JSON resource model for parent-scoped listing (e.g. parent identifier)

Resources

state(infinite)— GuardDuty Master resource state

@swamp/aws/guardduty/memberv2026.08.17.2member.ts

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
Status?	string	no
MemberId?	string	no
Email	string	yes
Message?	string	no
DisableEmailNotification?	boolean	no
DetectorId?	string	no

fn create()

Create a GuardDuty Member

fn get(identifier: string)

Get a GuardDuty Member

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the GuardDuty Member

fn update()

Update a GuardDuty Member

fn delete(identifier: string)

Delete a GuardDuty Member

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the GuardDuty Member

fn sync()

Sync GuardDuty Member state from AWS

fn list(maxPages?: number, resourceModel?: string)

List GuardDuty Member resources

Argument	Type	Required	Description
maxPages?	number	no	Maximum number of pages to fetch (default: 10)
resourceModel?	string	no	JSON resource model for parent-scoped listing (e.g. parent identifier)

Resources

state(infinite)— GuardDuty Member resource state

@swamp/aws/guardduty/publishing-destinationv2026.08.17.2publishing_destination.ts

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
DetectorId	string	yes	The ID of the GuardDuty detector associated with the publishing destination.
DestinationType	string	yes	The type of resource for the publishing destination. Currently only Amazon S3 buckets are supported.
DestinationProperties	object	yes
Tags?	array	no

fn create()

Create a GuardDuty PublishingDestination

fn get(identifier: string)

Get a GuardDuty PublishingDestination

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the GuardDuty PublishingDestination

fn update()

Update a GuardDuty PublishingDestination

fn delete(identifier: string)

Delete a GuardDuty PublishingDestination

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the GuardDuty PublishingDestination

fn sync()

Sync GuardDuty PublishingDestination state from AWS

fn list(maxPages?: number, resourceModel?: string)

List GuardDuty PublishingDestination resources

Argument	Type	Required	Description
maxPages?	number	no	Maximum number of pages to fetch (default: 10)
resourceModel?	string	no	JSON resource model for parent-scoped listing (e.g. parent identifier)

Resources

state(infinite)— GuardDuty PublishingDestination resource state

@swamp/aws/guardduty/threat-entity-setv2026.08.17.2threat_entity_set.ts

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
Format	string	yes
Activate?	boolean	no
DetectorId?	string	no
Name?	string	no
Location	string	yes
ExpectedBucketOwner?	string	no
Tags?	array	no

fn create()

Create a GuardDuty ThreatEntitySet

fn get(identifier: string)

Get a GuardDuty ThreatEntitySet

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the GuardDuty ThreatEntitySet

fn update()

Update a GuardDuty ThreatEntitySet

fn delete(identifier: string)

Delete a GuardDuty ThreatEntitySet

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the GuardDuty ThreatEntitySet

fn sync()

Sync GuardDuty ThreatEntitySet state from AWS

fn list(maxPages?: number, resourceModel?: string)

List GuardDuty ThreatEntitySet resources

Argument	Type	Required	Description
maxPages?	number	no	Maximum number of pages to fetch (default: 10)
resourceModel?	string	no	JSON resource model for parent-scoped listing (e.g. parent identifier)

Resources

state(infinite)— GuardDuty ThreatEntitySet resource state

@swamp/aws/guardduty/threat-intel-setv2026.08.17.2threat_intel_set.ts

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
Format	string	yes
Activate?	boolean	no
DetectorId?	string	no
Name?	string	no
Location	string	yes
ExpectedBucketOwner?	string	no
Tags?	array	no

fn create()

Create a GuardDuty ThreatIntelSet

fn get(identifier: string)

Get a GuardDuty ThreatIntelSet

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the GuardDuty ThreatIntelSet

fn update()

Update a GuardDuty ThreatIntelSet

fn delete(identifier: string)

Delete a GuardDuty ThreatIntelSet

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the GuardDuty ThreatIntelSet

fn sync()

Sync GuardDuty ThreatIntelSet state from AWS

fn list(maxPages?: number, resourceModel?: string)

List GuardDuty ThreatIntelSet resources

Argument	Type	Required	Description
maxPages?	number	no	Maximum number of pages to fetch (default: 10)
resourceModel?	string	no	JSON resource model for parent-scoped listing (e.g. parent identifier)

Resources

state(infinite)— GuardDuty ThreatIntelSet resource state

@swamp/aws/guardduty/trusted-entity-setv2026.08.17.2trusted_entity_set.ts

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
Format	string	yes
Activate?	boolean	no
DetectorId?	string	no
Name?	string	no
Location	string	yes
ExpectedBucketOwner?	string	no
Tags?	array	no

fn create()

Create a GuardDuty TrustedEntitySet

fn get(identifier: string)

Get a GuardDuty TrustedEntitySet

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the GuardDuty TrustedEntitySet

fn update()

Update a GuardDuty TrustedEntitySet

fn delete(identifier: string)

Delete a GuardDuty TrustedEntitySet

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the GuardDuty TrustedEntitySet

fn sync()

Sync GuardDuty TrustedEntitySet state from AWS

fn list(maxPages?: number, resourceModel?: string)

List GuardDuty TrustedEntitySet resources

Argument	Type	Required	Description
maxPages?	number	no	Maximum number of pages to fetch (default: 10)
resourceModel?	string	no	JSON resource model for parent-scoped listing (e.g. parent identifier)

Resources

state(infinite)— GuardDuty TrustedEntitySet resource state

03Previous Versions19

2026.09.20.1Sep 20, 2026

2026.09.19.1Sep 19, 2026

2026.09.18.1Sep 18, 2026

2026.09.17.1Sep 17, 2026

2026.09.16.1Sep 16, 2026

2026.09.15.1Sep 15, 2026

2026.09.14.1Sep 14, 2026

2026.09.13.1Sep 13, 2026

2026.09.12.1Sep 12, 2026

2026.09.11.1Sep 11, 2026

2026.09.10.1Sep 10, 2026

2026.09.09.1Sep 9, 2026

2026.09.08.1Sep 8, 2026

2026.09.07.1Sep 7, 2026

2026.09.06.3Sep 7, 2026

2026.09.06.1Sep 6, 2026

2026.09.05.1Sep 5, 2026

2026.09.04.1Sep 4, 2026

2026.09.03.1Sep 3, 2026

04Stats

100 / 100

Downloads

Archive size

2.2 MB

Verified by Swamp

Has README or module doc2/2earned
README has a code example1/1earned
README is substantive1/1earned
Most symbols documented1/1earned
No slow types (deprecated)1/1earned
Dependencies pass trust audit2/2earned
Has description1/1earned
Platform support declared (or universal)2/2earned
License declared1/1earned
Verified public repository2/2earned

Repository

https://github.com/swamp-club/swamp-extensions

05Platforms

linux · x86_64 linux · aarch64 macOS · x86_64 macOS · aarch64

06Labels

#aws #guardduty #cloud #infrastructure