Check ID: guardduty_delegated_admin_enabled_all_regions
Provider: AWS
Service: guardduty
Severity: HIGH
Categories: forensics-ready
Resource type: AwsGuardDutyDetector

​
What this check verifies

Amazon GuardDuty has a delegated administrator configured at the organization level, detectors are enabled in all opted-in regions, and organization auto-enable is active for new member accounts.

​
Risk

Without org-wide Amazon GuardDuty configuration, gaps can occur where detectors are enabled in some regions but not others, delegated admin is inconsistent, and new accounts are not auto-enrolled. This fragments threat visibility, delays incident response, and allows adversaries to exploit unmonitored regions or accounts for lateral movement and data exfiltration.

​
Recommendation

Configure a delegated administrator for GuardDuty via AWS Organizations. Enable GuardDuty detectors in all opted-in regions and configure auto-enable to automatically enroll new member accounts. This ensures consistent threat detection coverage across the entire organization.

​
Remediation

aws guardduty enable-organization-admin-account —admin-account-id <ADMIN_ACCOUNT_ID> && aws guardduty update-organization-configuration —detector-id <DETECTOR_ID> —auto-enable-organization-members ALL

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = guardduty_delegated_admin_enabled_all_regions. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks