Skip to main content
← back to extensions

Aws/guardduty

@webframp/aws/guarddutyv2026.08.05.1· 1d agoMODELS
01README

Read-only observability model for GuardDuty findings. Query and inspect findings from a delegated administrator account, covering all member accounts in an AWS Organization.

This extension does not manage GuardDuty configuration (detectors, publishing destinations, IP sets). For infrastructure management, use @swamp/aws/guardduty/detector.

Prerequisites

GuardDuty must be enabled (a detector must exist) in the target region. If no detector is found, methods return an error with setup instructions.

Authentication

Uses the default AWS credential chain. Point at the delegated admin account (e.g. via AWS_PROFILE or the profile global argument) to see findings across all member accounts.

Required IAM Permissions

  • guardduty:ListDetectors
  • guardduty:ListFindings
  • guardduty:GetFindings
  • guardduty:ListMembers

Usage

# Create guardduty model (assumes credentials for delegated admin account)
swamp model create @webframp/aws/guardduty gd --global-arg region=us-east-1

# List recent high-severity findings
swamp model method run gd list_findings --input severityMin=7 --input startTime=7d

# List findings by type
swamp model method run gd list_findings --input typePrefix=UnauthorizedAccess

# Filter to a specific account
swamp model method run gd list_findings --input accountId=238297461743

# Get full details for specific findings
swamp model method run gd get_finding_details --input 'findingIds=["abc123"]'

# List enrolled member accounts
swamp model method run gd list_members

Methods

  • list_findings - List findings with filters for type, severity, time window, and account
  • get_finding_details - Get full resource and service action details for specific findings
  • list_members - List member accounts and their enrollment status
02Release Notes

2026.08.05.1

Changed: Bump @aws-sdk/* 3.1101.0 → 3.1104.0 (2 packages)

2026.08.02.1

Changed: Bump @aws-sdk/* 3.1100.0 → 3.1101.0 (2 packages)

2026.08.01.1

Fixed: Broken model-upgrade chain. The prior version bump (to 2026.07.31.1) updated version but left the upgrades array terminating one step short, which blocks swamp extension push ("model upgrade chain errors"). That version never actually published — the registry was still serving 2026.07.30.2. This release closes the chain with a no-op upgrade entry and republishes everything that had accumulated since 2026.07.30.2.

2026.07.31.1

Changed: Bump @aws-sdk/* 3.1096.0 → 3.1100.0 (2 packages)

2026.07.30.2

Added: Pre-flight check with actionable error message when no GuardDuty detector exists. The error now names the region, explains that GuardDuty must be enabled, and provides the exact swamp commands to create a detector via @swamp/aws/guardduty/detector.

Changed: Extension description and README clarify that this is a read-only observability model. A new Prerequisites section documents the detector requirement and links to the infrastructure model for setup.

03Models1
@webframp/aws/guarddutyv2026.08.05.1aws/guardduty.ts
fn list_findings()
List GuardDuty findings with optional filters for type, severity, time window, and account
fn get_finding_details()
Get full details for specific findings by ID, including resource and service action data
fn list_members()
List GuardDuty member accounts and their enrollment status

Resources

finding_list(30m)— List of GuardDuty finding summaries
finding_details(1h)— Full GuardDuty finding details
member_list(1h)— GuardDuty member account enrollment
04Previous Versions13
2026.08.02.1

2026.08.02.1

Changed: Bump @aws-sdk/* 3.1100.0 → 3.1101.0 (2 packages)

2026.08.01.1

Fixed: Broken model-upgrade chain. The prior version bump (to 2026.07.31.1) updated version but left the upgrades array terminating one step short, which blocks swamp extension push ("model upgrade chain errors"). That version never actually published — the registry was still serving 2026.07.30.2. This release closes the chain with a no-op upgrade entry and republishes everything that had accumulated since 2026.07.30.2.

2026.07.31.1

Changed: Bump @aws-sdk/* 3.1096.0 → 3.1100.0 (2 packages)

2026.07.30.2

Added: Pre-flight check with actionable error message when no GuardDuty detector exists. The error now names the region, explains that GuardDuty must be enabled, and provides the exact swamp commands to create a detector via @swamp/aws/guardduty/detector.

Changed: Extension description and README clarify that this is a read-only observability model. A new Prerequisites section documents the detector requirement and links to the infrastructure model for setup.

2026.08.01.1

2026.08.01.1

Fixed: Broken model-upgrade chain. The prior version bump (to 2026.07.31.1) updated version but left the upgrades array terminating one step short, which blocks swamp extension push ("model upgrade chain errors"). That version never actually published — the registry was still serving 2026.07.30.2. This release closes the chain with a no-op upgrade entry and republishes everything that had accumulated since 2026.07.30.2.

2026.07.31.1

Changed: Bump @aws-sdk/* 3.1096.0 → 3.1100.0 (2 packages)

2026.07.30.2

Added: Pre-flight check with actionable error message when no GuardDuty detector exists. The error now names the region, explains that GuardDuty must be enabled, and provides the exact swamp commands to create a detector via @swamp/aws/guardduty/detector.

Changed: Extension description and README clarify that this is a read-only observability model. A new Prerequisites section documents the detector requirement and links to the infrastructure model for setup.

2026.07.30.2

2026.07.30.2

Added: Pre-flight check with actionable error message when no GuardDuty detector exists. The error now names the region, explains that GuardDuty must be enabled, and provides the exact swamp commands to create a detector via @swamp/aws/guardduty/detector.

Changed: Extension description and README clarify that this is a read-only observability model. A new Prerequisites section documents the detector requirement and links to the infrastructure model for setup.

2026.07.30.1

2026.07.30.1

Added: Optional profile global argument for multi-account credential resolution. When set, credentials resolve via fromIni (supports SSO token cache and shared-config profiles). When omitted, the default credential chain applies as before. Fully backward compatible — no changes required for existing instances.

2026.07.29.1

2026.07.29.1

Fixed: Terminate upgrade chain at current version (extension was uninstallable due to broken upgrade chain).

2026.07.27.1

Changed: Bump @aws-sdk/client-guardduty 3.1094.0 → 3.1096.0

2026.07.24.1

Changed: Bump AWS SDK from 3.1091.0 to 3.1094.0 (patch-level update).

2026.07.24.1

2026.07.24.1

Changed: Bump AWS SDK from 3.1091.0 to 3.1094.0 (patch-level update).

2026.07.21.1

2026.07.21.1

Changed: Bumped AWS SDK dependencies to 3.1091.0 (from 3.1090.0).

Upgrade note: No behavioral changes. Routine dependency maintenance.

2026.07.18.2

2026.07.18.2

Added: An upgrades array entry (no-op) to guardduty.ts for proper typeVersion tracking on existing instances. No schema or behavior changes.

2026.07.18.1

Changed: Bumped @aws-sdk/client-guardduty from 3.1069.0 to 3.1090.0 for dependency freshness. No behavior change.

2026.07.18.1

2026.07.18.1

Changed: Bumped @aws-sdk/client-guardduty from 3.1069.0 to 3.1090.0 for dependency freshness. No behavior change.

2026.06.21.1
2026.06.15.1
2026.05.20.1
2026.04.28.1
05Stats
A
100 / 100
Downloads
3
Archive size
280.5 KB
  • Has README or module doc2/2earned
  • README has a code example1/1earned
  • README is substantive1/1earned
  • Most symbols documented1/1earned
  • No slow types (deprecated)1/1earned
  • Dependencies pass trust audit2/2earned
  • Has description1/1earned
  • Platform support declared (or universal)2/2earned
  • License declared1/1earned
  • Verified public repository2/2earned
Repository
https://github.com/webframp/swamp-extensions
06Platforms
07Labels
#aws#guardduty#security#threat-detection#incident-response