Aws/guardduty
Read-only observability model for GuardDuty findings. Query and inspect findings from a delegated administrator account, covering all member accounts in an AWS Organization.
This extension does not manage GuardDuty configuration (detectors, publishing destinations, IP sets). For infrastructure management, use @swamp/aws/guardduty/detector.
Prerequisites
GuardDuty must be enabled (a detector must exist) in the target region. If no detector is found, methods return an error with setup instructions.
Authentication
Uses the default AWS credential chain. Point at the delegated admin account
(e.g. via AWS_PROFILE or the profile global argument) to see findings
across all member accounts.
Required IAM Permissions
guardduty:ListDetectorsguardduty:ListFindingsguardduty:GetFindingsguardduty:ListMembers
Usage
# Create guardduty model (assumes credentials for delegated admin account)
swamp model create @webframp/aws/guardduty gd --global-arg region=us-east-1
# List recent high-severity findings
swamp model method run gd list_findings --input severityMin=7 --input startTime=7d
# List findings by type
swamp model method run gd list_findings --input typePrefix=UnauthorizedAccess
# Filter to a specific account
swamp model method run gd list_findings --input accountId=238297461743
# Get full details for specific findings
swamp model method run gd get_finding_details --input 'findingIds=["abc123"]'
# List enrolled member accounts
swamp model method run gd list_membersMethods
- list_findings - List findings with filters for type, severity, time window, and account
- get_finding_details - Get full resource and service action details for specific findings
- list_members - List member accounts and their enrollment status
2026.09.18.1
Upgrade note: Normalized npm:zod dependency version to 4.6.5 across the
repo. No behavioral changes in this extension.
Resources
2026.09.17.1
Changed: Bump @aws-sdk/* 3.1131.0 → 3.1133.0 (2 packages)
2026.09.15.1
Changed: Bump zod 4.4.3 → 4.6.5
2026.09.14.1
Changed: Bump @aws-sdk/* 3.1126.0 → 3.1131.0 (2 packages)
2026.09.04.1
Changed: Bump @aws-sdk/* 3.1121.0 → 3.1126.0 (2 packages)
2026.08.29.1
Changed: Bump @aws-sdk/* 3.1120.0 → 3.1121.0. Dependency-only update; no schema, API, or behavioral changes.
2026.08.28.2
Changed: Normalized the extension license to Apache-2.0 and corrected the copyright holder to "Sean Escriva". Extensions that previously shipped an MIT LICENSE.md are now Apache-2.0, consistent with the repository root and every other extension. No code or behavioral changes.
Upgrade note: License text only. No API, schema, or runtime behavior changed.
2026.08.28.1
Changed: Bump @aws-sdk/* 3.1114.0 → 3.1120.0 (2 packages)
2026.08.26.3
Fixed: Restored inline npm:zod@4.4.3 import specifiers so the registry
quality scorer can resolve dependencies and score the extension. An earlier
release used a bare "zod" import-map specifier, which published but scored as
unscored.
Changed: Retained explicit compilerOptions.strict in deno.json. No
behavioral or schema changes.
2026.09.15.1
Changed: Bump zod 4.4.3 → 4.6.5
2026.09.14.1
Changed: Bump @aws-sdk/* 3.1126.0 → 3.1131.0 (2 packages)
2026.09.04.1
Changed: Bump @aws-sdk/* 3.1121.0 → 3.1126.0 (2 packages)
2026.08.29.1
Changed: Bump @aws-sdk/* 3.1120.0 → 3.1121.0. Dependency-only update; no schema, API, or behavioral changes.
2026.08.28.2
Changed: Normalized the extension license to Apache-2.0 and corrected the copyright holder to "Sean Escriva". Extensions that previously shipped an MIT LICENSE.md are now Apache-2.0, consistent with the repository root and every other extension. No code or behavioral changes.
Upgrade note: License text only. No API, schema, or runtime behavior changed.
2026.08.28.1
Changed: Bump @aws-sdk/* 3.1114.0 → 3.1120.0 (2 packages)
2026.08.26.3
Fixed: Restored inline npm:zod@4.4.3 import specifiers so the registry
quality scorer can resolve dependencies and score the extension. An earlier
release used a bare "zod" import-map specifier, which published but scored as
unscored.
Changed: Retained explicit compilerOptions.strict in deno.json. No
behavioral or schema changes.
2026.09.04.1
Changed: Bump @aws-sdk/* 3.1121.0 → 3.1126.0 (2 packages)
2026.08.29.1
Changed: Bump @aws-sdk/* 3.1120.0 → 3.1121.0. Dependency-only update; no schema, API, or behavioral changes.
2026.08.28.2
Changed: Normalized the extension license to Apache-2.0 and corrected the copyright holder to "Sean Escriva". Extensions that previously shipped an MIT LICENSE.md are now Apache-2.0, consistent with the repository root and every other extension. No code or behavioral changes.
Upgrade note: License text only. No API, schema, or runtime behavior changed.
2026.08.28.1
Changed: Bump @aws-sdk/* 3.1114.0 → 3.1120.0 (2 packages)
2026.08.26.3
Fixed: Restored inline npm:zod@4.4.3 import specifiers so the registry
quality scorer can resolve dependencies and score the extension. An earlier
release used a bare "zod" import-map specifier, which published but scored as
unscored.
Changed: Retained explicit compilerOptions.strict in deno.json. No
behavioral or schema changes.
2026.08.29.1
Changed: Bump @aws-sdk/* 3.1120.0 → 3.1121.0. Dependency-only update; no schema, API, or behavioral changes.
2026.08.28.2
Changed: Normalized the extension license to Apache-2.0 and corrected the copyright holder to "Sean Escriva". Extensions that previously shipped an MIT LICENSE.md are now Apache-2.0, consistent with the repository root and every other extension. No code or behavioral changes.
Upgrade note: License text only. No API, schema, or runtime behavior changed.
2026.08.28.1
Changed: Bump @aws-sdk/* 3.1114.0 → 3.1120.0 (2 packages)
2026.08.26.3
Fixed: Restored inline npm:zod@4.4.3 import specifiers so the registry
quality scorer can resolve dependencies and score the extension. An earlier
release used a bare "zod" import-map specifier, which published but scored as
unscored.
Changed: Retained explicit compilerOptions.strict in deno.json. No
behavioral or schema changes.
2026.08.28.2
Changed: Normalized the extension license to Apache-2.0 and corrected the copyright holder to "Sean Escriva". Extensions that previously shipped an MIT LICENSE.md are now Apache-2.0, consistent with the repository root and every other extension. No code or behavioral changes.
Upgrade note: License text only. No API, schema, or runtime behavior changed.
2026.08.28.1
Changed: Bump @aws-sdk/* 3.1114.0 → 3.1120.0 (2 packages)
2026.08.26.3
Fixed: Restored inline npm:zod@4.4.3 import specifiers so the registry
quality scorer can resolve dependencies and score the extension. An earlier
release used a bare "zod" import-map specifier, which published but scored as
unscored.
Changed: Retained explicit compilerOptions.strict in deno.json. No
behavioral or schema changes.
2026.08.28.1
Changed: Bump @aws-sdk/* 3.1114.0 → 3.1120.0 (2 packages)
2026.08.26.3
Fixed: Restored inline npm:zod@4.4.3 import specifiers so the registry
quality scorer can resolve dependencies and score the extension. An earlier
release used a bare "zod" import-map specifier, which published but scored as
unscored.
Changed: Retained explicit compilerOptions.strict in deno.json. No
behavioral or schema changes.
2026.08.26.3
Fixed: Restored inline npm:zod@4.4.3 import specifiers so the registry
quality scorer can resolve dependencies and score the extension. An earlier
release used a bare "zod" import-map specifier, which published but scored as
unscored.
Changed: Retained explicit compilerOptions.strict in deno.json. No
behavioral or schema changes.
2026.08.26.1
Fixed: Added missing description field to upgrade entry for version
2026.08.24.2. The omission caused swamp extension pull to fail with a catalog
validation error ("upgrades.N.description: Invalid input: expected string,
received undefined").
2026.08.25.1
Changed: Updated labels for improved extension discoverability. Added cross-cutting category labels (security, observability, finops, infrastructure, networking, compliance, devops, ai, incident-response) where applicable.
updated labels
2026.08.24.3
Added: Output metadata attributes for observability.
durationMs: Method execution duration in milliseconds.collectedBy: Extension name that produced the data.fetchedAt: ISO 8601 timestamp when data was fetched (added to resources that previously lacked it).
2026.08.24.2
Added: Troubleshooting section documenting detector-not-found errors,
typePrefix client-side filtering and its truncation semantics, region-scope
guidance, the 50-ID cap on get_finding_details, and the onlyAssociated
default in list_members.
2026.08.21.1
Changed: GuardDuty API failures now name the operation and detector/finding
IDs involved instead of surfacing the raw SDK error. ListDetectors,
ListFindings, GetFindings (in both list_findings and
get_finding_details), and ListMembers failures all raise a clear error
identifying what was being fetched and for which detector, with the original
SDK error preserved as the cause.
list_findings's severityMin argument now enforces the documented 0-10
range at the schema level instead of silently accepting out-of-range values
that GuardDuty would reject deep inside the API call.
No schema changes.
2026.08.20.1
Changed: Bump @aws-sdk/* 3.1111.0 → 3.1114.0 (2 packages)
2026.08.15.1
Changed: Bump @aws-sdk/* 3.1104.0 → 3.1111.0 (2 packages)
2026.08.05.1
Changed: Bump @aws-sdk/* 3.1101.0 → 3.1104.0 (2 packages)
2026.08.02.1
Changed: Bump @aws-sdk/* 3.1100.0 → 3.1101.0 (2 packages)
2026.08.01.1
Fixed: Broken model-upgrade chain. The prior version bump (to 2026.07.31.1) updated version but left the upgrades array terminating one step short, which blocks swamp extension push ("model upgrade chain errors"). That version never actually published — the registry was still serving 2026.07.30.2. This release closes the chain with a no-op upgrade entry and republishes everything that had accumulated since 2026.07.30.2.
2026.07.31.1
Changed: Bump @aws-sdk/* 3.1096.0 → 3.1100.0 (2 packages)
2026.07.30.2
Added: Pre-flight check with actionable error message when no GuardDuty detector
exists. The error now names the region, explains that GuardDuty must be enabled, and
provides the exact swamp commands to create a detector via @swamp/aws/guardduty/detector.
Changed: Extension description and README clarify that this is a read-only observability model. A new Prerequisites section documents the detector requirement and links to the infrastructure model for setup.
2026.08.15.1
Changed: Bump @aws-sdk/* 3.1104.0 → 3.1111.0 (2 packages)
2026.08.05.1
Changed: Bump @aws-sdk/* 3.1101.0 → 3.1104.0 (2 packages)
2026.08.02.1
Changed: Bump @aws-sdk/* 3.1100.0 → 3.1101.0 (2 packages)
2026.08.01.1
Fixed: Broken model-upgrade chain. The prior version bump (to 2026.07.31.1) updated version but left the upgrades array terminating one step short, which blocks swamp extension push ("model upgrade chain errors"). That version never actually published — the registry was still serving 2026.07.30.2. This release closes the chain with a no-op upgrade entry and republishes everything that had accumulated since 2026.07.30.2.
2026.07.31.1
Changed: Bump @aws-sdk/* 3.1096.0 → 3.1100.0 (2 packages)
2026.07.30.2
Added: Pre-flight check with actionable error message when no GuardDuty detector
exists. The error now names the region, explains that GuardDuty must be enabled, and
provides the exact swamp commands to create a detector via @swamp/aws/guardduty/detector.
Changed: Extension description and README clarify that this is a read-only observability model. A new Prerequisites section documents the detector requirement and links to the infrastructure model for setup.
2026.08.05.1
Changed: Bump @aws-sdk/* 3.1101.0 → 3.1104.0 (2 packages)
2026.08.02.1
Changed: Bump @aws-sdk/* 3.1100.0 → 3.1101.0 (2 packages)
2026.08.01.1
Fixed: Broken model-upgrade chain. The prior version bump (to 2026.07.31.1) updated version but left the upgrades array terminating one step short, which blocks swamp extension push ("model upgrade chain errors"). That version never actually published — the registry was still serving 2026.07.30.2. This release closes the chain with a no-op upgrade entry and republishes everything that had accumulated since 2026.07.30.2.
2026.07.31.1
Changed: Bump @aws-sdk/* 3.1096.0 → 3.1100.0 (2 packages)
2026.07.30.2
Added: Pre-flight check with actionable error message when no GuardDuty detector
exists. The error now names the region, explains that GuardDuty must be enabled, and
provides the exact swamp commands to create a detector via @swamp/aws/guardduty/detector.
Changed: Extension description and README clarify that this is a read-only observability model. A new Prerequisites section documents the detector requirement and links to the infrastructure model for setup.
2026.08.02.1
Changed: Bump @aws-sdk/* 3.1100.0 → 3.1101.0 (2 packages)
2026.08.01.1
Fixed: Broken model-upgrade chain. The prior version bump (to 2026.07.31.1) updated version but left the upgrades array terminating one step short, which blocks swamp extension push ("model upgrade chain errors"). That version never actually published — the registry was still serving 2026.07.30.2. This release closes the chain with a no-op upgrade entry and republishes everything that had accumulated since 2026.07.30.2.
2026.07.31.1
Changed: Bump @aws-sdk/* 3.1096.0 → 3.1100.0 (2 packages)
2026.07.30.2
Added: Pre-flight check with actionable error message when no GuardDuty detector
exists. The error now names the region, explains that GuardDuty must be enabled, and
provides the exact swamp commands to create a detector via @swamp/aws/guardduty/detector.
Changed: Extension description and README clarify that this is a read-only observability model. A new Prerequisites section documents the detector requirement and links to the infrastructure model for setup.
2026.08.01.1
Fixed: Broken model-upgrade chain. The prior version bump (to 2026.07.31.1) updated version but left the upgrades array terminating one step short, which blocks swamp extension push ("model upgrade chain errors"). That version never actually published — the registry was still serving 2026.07.30.2. This release closes the chain with a no-op upgrade entry and republishes everything that had accumulated since 2026.07.30.2.
2026.07.31.1
Changed: Bump @aws-sdk/* 3.1096.0 → 3.1100.0 (2 packages)
2026.07.30.2
Added: Pre-flight check with actionable error message when no GuardDuty detector
exists. The error now names the region, explains that GuardDuty must be enabled, and
provides the exact swamp commands to create a detector via @swamp/aws/guardduty/detector.
Changed: Extension description and README clarify that this is a read-only observability model. A new Prerequisites section documents the detector requirement and links to the infrastructure model for setup.
2026.07.30.2
Added: Pre-flight check with actionable error message when no GuardDuty detector
exists. The error now names the region, explains that GuardDuty must be enabled, and
provides the exact swamp commands to create a detector via @swamp/aws/guardduty/detector.
Changed: Extension description and README clarify that this is a read-only observability model. A new Prerequisites section documents the detector requirement and links to the infrastructure model for setup.
- Has README or module doc2/2earned
- README has a code example1/1earned
- README is substantive1/1earned
- Most symbols documented1/1earned
- No slow types (deprecated)1/1earned
- Dependencies pass trust audit2/2earned
- Has description1/1earned
- Platform support declared (or universal)2/2earned
- License declared1/1earned
- Verified public repository2/2earned