Aws/guardduty

@swamp/aws/guarddutyv2026.08.07.1· 1d agoMODELS

01README

AWS GUARDDUTY infrastructure models

02Models10

@swamp/aws/guardduty/detectorv2026.06.15.1detector.ts

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
FindingPublishingFrequency?	string	no
Enable	boolean	yes
DataSources?	object	no
Features?	array	no
Tags?	array	no

fn create()

Create a GuardDuty Detector

fn get(identifier: string)

Get a GuardDuty Detector

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the GuardDuty Detector

fn update()

Update a GuardDuty Detector

fn delete(identifier: string)

Delete a GuardDuty Detector

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the GuardDuty Detector

fn sync()

Sync GuardDuty Detector state from AWS

Resources

state(infinite)— GuardDuty Detector resource state

@swamp/aws/guardduty/filterv2026.06.15.1filter.ts

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
Action?	string	no
Description?	string	no
DetectorId	string	yes
FindingCriteria	object	yes
Rank?	number	no
Name	string	yes
Tags?	array	no

fn create()

Create a GuardDuty Filter

fn get(identifier: string)

Get a GuardDuty Filter

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the GuardDuty Filter

fn update()

Update a GuardDuty Filter

fn delete(identifier: string)

Delete a GuardDuty Filter

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the GuardDuty Filter

fn sync()

Sync GuardDuty Filter state from AWS

Resources

state(infinite)— GuardDuty Filter resource state

@swamp/aws/guardduty/ipsetv2026.06.15.1ipset.ts

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
Format	string	yes
Activate?	boolean	no
DetectorId?	string	no
Name?	string	no
Location	string	yes
ExpectedBucketOwner?	string	no
Tags?	array	no

fn create()

Create a GuardDuty IPSet

fn get(identifier: string)

Get a GuardDuty IPSet

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the GuardDuty IPSet

fn update()

Update a GuardDuty IPSet

fn delete(identifier: string)

Delete a GuardDuty IPSet

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the GuardDuty IPSet

fn sync()

Sync GuardDuty IPSet state from AWS

Resources

state(infinite)— GuardDuty IPSet resource state

@swamp/aws/guardduty/malware-protection-planv2026.06.15.1malware_protection_plan.ts

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
Role	string	yes	IAM role that includes the permissions required to scan and (optionally) add tags to the associated protected resource.
ProtectedResource	object	yes	Information about the protected resource. Presently, S3Bucket is the only supported protected resource.
Tags?	array	no	The tags to be added to the created Malware Protection plan resource. Each tag consists of a key and an optional value, both of which you need to specify.

fn create()

Create a GuardDuty MalwareProtectionPlan

fn get(identifier: string)

Get a GuardDuty MalwareProtectionPlan

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the GuardDuty MalwareProtectionPlan

fn update()

Update a GuardDuty MalwareProtectionPlan

fn delete(identifier: string)

Delete a GuardDuty MalwareProtectionPlan

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the GuardDuty MalwareProtectionPlan

fn sync()

Sync GuardDuty MalwareProtectionPlan state from AWS

Resources

state(infinite)— GuardDuty MalwareProtectionPlan resource state

@swamp/aws/guardduty/masterv2026.06.15.1master.ts

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
MasterId	string	yes	ID of the account used as the master account.
InvitationId?	string	no	Value used to validate the master account to the member account.
DetectorId	string	yes	Unique ID of the detector of the GuardDuty member account.

fn create()

Create a GuardDuty Master

fn get(identifier: string)

Get a GuardDuty Master

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the GuardDuty Master

fn delete(identifier: string)

Delete a GuardDuty Master

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the GuardDuty Master

fn sync()

Sync GuardDuty Master state from AWS

Resources

state(infinite)— GuardDuty Master resource state

@swamp/aws/guardduty/memberv2026.06.15.1member.ts

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
Status?	string	no
MemberId?	string	no
Email	string	yes
Message?	string	no
DisableEmailNotification?	boolean	no
DetectorId?	string	no

fn create()

Create a GuardDuty Member

fn get(identifier: string)

Get a GuardDuty Member

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the GuardDuty Member

fn update()

Update a GuardDuty Member

fn delete(identifier: string)

Delete a GuardDuty Member

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the GuardDuty Member

fn sync()

Sync GuardDuty Member state from AWS

Resources

state(infinite)— GuardDuty Member resource state

@swamp/aws/guardduty/publishing-destinationv2026.06.15.1publishing_destination.ts

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
DetectorId	string	yes	The ID of the GuardDuty detector associated with the publishing destination.
DestinationType	string	yes	The type of resource for the publishing destination. Currently only Amazon S3 buckets are supported.
DestinationProperties	object	yes
Tags?	array	no

fn create()

Create a GuardDuty PublishingDestination

fn get(identifier: string)

Get a GuardDuty PublishingDestination

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the GuardDuty PublishingDestination

fn update()

Update a GuardDuty PublishingDestination

fn delete(identifier: string)

Delete a GuardDuty PublishingDestination

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the GuardDuty PublishingDestination

fn sync()

Sync GuardDuty PublishingDestination state from AWS

Resources

state(infinite)— GuardDuty PublishingDestination resource state

@swamp/aws/guardduty/threat-entity-setv2026.06.15.1threat_entity_set.ts

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
Format	string	yes
Activate?	boolean	no
DetectorId?	string	no
Name?	string	no
Location	string	yes
ExpectedBucketOwner?	string	no
Tags?	array	no

fn create()

Create a GuardDuty ThreatEntitySet

fn get(identifier: string)

Get a GuardDuty ThreatEntitySet

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the GuardDuty ThreatEntitySet

fn update()

Update a GuardDuty ThreatEntitySet

fn delete(identifier: string)

Delete a GuardDuty ThreatEntitySet

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the GuardDuty ThreatEntitySet

fn sync()

Sync GuardDuty ThreatEntitySet state from AWS

Resources

state(infinite)— GuardDuty ThreatEntitySet resource state

@swamp/aws/guardduty/threat-intel-setv2026.06.15.1threat_intel_set.ts

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
Format	string	yes
Activate?	boolean	no
DetectorId?	string	no
Name?	string	no
Location	string	yes
ExpectedBucketOwner?	string	no
Tags?	array	no

fn create()

Create a GuardDuty ThreatIntelSet

fn get(identifier: string)

Get a GuardDuty ThreatIntelSet

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the GuardDuty ThreatIntelSet

fn update()

Update a GuardDuty ThreatIntelSet

fn delete(identifier: string)

Delete a GuardDuty ThreatIntelSet

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the GuardDuty ThreatIntelSet

fn sync()

Sync GuardDuty ThreatIntelSet state from AWS

Resources

state(infinite)— GuardDuty ThreatIntelSet resource state

@swamp/aws/guardduty/trusted-entity-setv2026.06.15.1trusted_entity_set.ts

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
Format	string	yes
Activate?	boolean	no
DetectorId?	string	no
Name?	string	no
Location	string	yes
ExpectedBucketOwner?	string	no
Tags?	array	no

fn create()

Create a GuardDuty TrustedEntitySet

fn get(identifier: string)

Get a GuardDuty TrustedEntitySet

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the GuardDuty TrustedEntitySet

fn update()

Update a GuardDuty TrustedEntitySet

fn delete(identifier: string)

Delete a GuardDuty TrustedEntitySet

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the GuardDuty TrustedEntitySet

fn sync()

Sync GuardDuty TrustedEntitySet state from AWS

Resources

state(infinite)— GuardDuty TrustedEntitySet resource state

03Previous Versions19

2026.08.06.1Aug 6, 2026

2026.08.05.1Aug 5, 2026

2026.08.04.1Aug 4, 2026

2026.08.03.1Aug 3, 2026

2026.08.02.1Aug 2, 2026

2026.08.01.1Aug 1, 2026

2026.07.31.1Jul 31, 2026

2026.07.30.1Jul 30, 2026

2026.07.29.1Jul 29, 2026

2026.07.28.1Jul 28, 2026

2026.07.27.1Jul 27, 2026

2026.07.26.1Jul 26, 2026

2026.07.25.1Jul 25, 2026

2026.07.24.1Jul 24, 2026

2026.07.20.1Jul 20, 2026

2026.07.18.3Jul 18, 2026

2026.07.18.2Jul 18, 2026

Added 10, removed 1 models

2026.06.15.1Jun 15, 2026

Updated: detector, filter, ipset, malware_protection_plan, master, member, publishing_destination, threat_entity_set, threat_intel_set, trusted_entity_set

2026.06.08.2Jun 8, 2026

Updated: detector, filter, ipset, malware_protection_plan, master, member, publishing_destination, threat_entity_set, threat_intel_set, trusted_entity_set

04Stats

100 / 100

Downloads

Archive size

2.2 MB

Verified by Swamp

Has README or module doc2/2earned
README has a code example1/1earned
README is substantive1/1earned
Most symbols documented1/1earned
No slow types (deprecated)1/1earned
Dependencies pass trust audit2/2earned
Has description1/1earned
Platform support declared (or universal)2/2earned
License declared1/1earned
Verified public repository2/2earned

Repository

https://github.com/swamp-club/swamp-extensions

05Platforms

linux · x86_64 linux · aarch64 macOS · x86_64 macOS · aarch64

06Labels

#aws #guardduty #cloud #infrastructure