Check ID: guardduty_centrally_managed
Provider: AWS
Service: guardduty
Severity: MEDIUM
Resource type: AwsGuardDutyDetector

​
What this check verifies

Amazon GuardDuty detectors are under centralized management when linked to a delegated administrator account, or when the detector’s account serves as the administrator with associated member accounts.

​
Risk

Lack of central management fragments visibility and slows incident response across accounts and regions. Adversaries can persist unnoticed, perform lateral movement, exfiltrate data, and alter configurations, harming confidentiality, integrity, and availability.

​
Recommendation

Designate a delegated administrator (preferably via AWS Organizations) and enroll all accounts as members. Enable auto-enrollment for new accounts, standardize detector settings across required regions, and route findings to central monitoring. Apply least privilege and separation of duties.

​
Remediation

aws guardduty enable-organization-admin-account —admin-account-id <ADMIN_ACCOUNT_ID>

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = guardduty_centrally_managed. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks