GuardDuty

11 resource kinds. Generated from the operator's CRD schemas.

API Group: aws.konfig.io/v1alpha1

GuardDutyCustomDetectionRuleAssociation # CLOUD CONTROL · AWS::GuardDuty::CustomDetectionRuleAssociation

GuardDutyCustomDetectionRuleAssociation manages AWS::GuardDuty::CustomDetectionRuleAssociation through the AWS Cloud Control API.

kubectl get guarddutycustomdetectionruleassociations · example on GitHub

Example

# GuardDutyCustomDetectionRuleAssociation — GuardDuty
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/guardduty.html#guarddutycustomdetectionruleassociation
apiVersion: aws.konfig.io/v1alpha1
kind: GuardDutyCustomDetectionRuleAssociation
metadata:
  name: example-guarddutycustomdetectionruleassociation
  namespace: default
spec:
  mode: LIVE
  providerRef:
    name: example-guarddutycustomdetectionruleassociation
    region: us-east-1
  ruleId: example-id
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`mode`	enum	yes	Whether the rule runs in LIVE mode (generates findings) or DRY_RUN mode (evaluates without generating findings). Allowed: `LIVE, DRY_RUN`
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`ruleId`	string	yes	The catalog identifier of the custom detection rule to associate.
`tags`	array<object>	—	The tags applied to the association.
`tags[].key`	string	yes
`tags[].value`	string	yes

Status

Field	Type	Required	Description
`accountId`	string	—	The AWS account ID the association applies to.
`arn`	string	—	The Amazon Resource Name (ARN) of the association.
`associationId`	string	—	The service-generated unique identifier of the association.
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`createdAt`	string	—	The time the association was created.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`updatedAt`	string	—	The time the association was last updated.

GuardDutyDetector # GA

GuardDutyDetector is the Schema for managing GuardDuty detectors.

kubectl get guarddutydetectors · example on GitHub

Example

# GuardDutyDetector — GuardDuty
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/guardduty.html#guarddutydetector
apiVersion: aws.konfig.io/v1alpha1
kind: GuardDutyDetector
metadata:
  name: example-guarddutydetector
  namespace: default
spec:
  enable: true
  features:
  - name: example-guarddutydetector
    status: ENABLED
  findingPublishingFrequency: FIFTEEN_MINUTES
  providerRef:
    name: example-guarddutydetector
    region: us-east-1
  tags:
    environment: dev
    team: platform

Spec

Field	Type	Required	Description
`enable`	boolean	—	Enable specifies whether the detector is enabled.
`features`	array<object>	—	Features configures detector features.
`features[].name`	string	yes	Name of the feature (e.g.
`features[].status`	enum	yes	Status of the feature. Allowed: `ENABLED, DISABLED`
`findingPublishingFrequency`	enum	—	FindingPublishingFrequency is how frequently updated findings are exported. Allowed: `FIFTEEN_MINUTES, ONE_HOUR, SIX_HOURS`
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	map<string>	—	Tags are AWS resource tags applied when the detector is created.

Status

Field	Type	Required	Description
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`detectorId`	string	—	DetectorID is the unique ID of the detector.
`detectorStatus`	string	—	DetectorStatus is the ENABLED/DISABLED status reported by AWS.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.

GuardDutyFilter # CLOUD CONTROL · AWS::GuardDuty::Filter

GuardDutyFilter manages AWS::GuardDuty::Filter through the AWS Cloud Control API.

kubectl get guarddutyfilters · example on GitHub

Example

# GuardDutyFilter — GuardDuty
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/guardduty.html#guarddutyfilter
apiVersion: aws.konfig.io/v1alpha1
kind: GuardDutyFilter
metadata:
  name: example-guarddutyfilter
  namespace: default
spec:
  action: example
  description: Managed by konfig-konector
  detectorId: example-id
  findingCriteria:
    criterion: {}
  name: example-guarddutyfilter
  providerRef:
    name: example-guarddutyfilter
    region: us-east-1
  rank: 1
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`action`	string	—
`description`	string	—
`detectorId`	string	yes	Create-only in AWS: changing it requires replacing the resource.
`findingCriteria`	object	yes	GuardDutyFilterFindingCriteria is a nested property type of AWS::GuardDuty::Filter.
`findingCriteria.criterion`	map<string>	—
`name`	string	yes	Create-only in AWS: changing it requires replacing the resource.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`rank`	integer	—
`tags`	array<object>	—
`tags[].key`	string	yes
`tags[].value`	string	yes

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

GuardDutyIPSet # CLOUD CONTROL · AWS::GuardDuty::IPSet

GuardDutyIPSet manages AWS::GuardDuty::IPSet through the AWS Cloud Control API.

kubectl get guarddutyipsets · example on GitHub

Example

# GuardDutyIPSet — GuardDuty
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/guardduty.html#guarddutyipset
apiVersion: aws.konfig.io/v1alpha1
kind: GuardDutyIPSet
metadata:
  name: example-guarddutyipset
  namespace: default
spec:
  activate: false
  expectedBucketOwner: example
  format: example
  location: example
  name: example-guarddutyipset
  providerRef:
    name: example-guarddutyipset
    region: us-east-1
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`activate`	boolean	—
`detectorId`	string	—	Create-only in AWS: changing it requires replacing the resource.
`expectedBucketOwner`	string	—
`format`	string	yes	Create-only in AWS: changing it requires replacing the resource.
`location`	string	yes
`name`	string	—
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	array<object>	—
`tags[].key`	string	yes
`tags[].value`	string	yes

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`id`	string	—	Read-only: reported by AWS after creation.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

GuardDutyMalwareProtectionPlan # CLOUD CONTROL · AWS::GuardDuty::MalwareProtectionPlan

GuardDutyMalwareProtectionPlan manages AWS::GuardDuty::MalwareProtectionPlan through the AWS Cloud Control API.

kubectl get guarddutymalwareprotectionplans · example on GitHub

Example

# GuardDutyMalwareProtectionPlan — GuardDuty
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/guardduty.html#guarddutymalwareprotectionplan
apiVersion: aws.konfig.io/v1alpha1
kind: GuardDutyMalwareProtectionPlan
metadata:
  name: example-guarddutymalwareprotectionplan
  namespace: default
spec:
  actions:
    tagging:
      status: example
  protectedResource:
    s3Bucket:
      bucketName: example-guarddutymalwareprotectionplan
      objectPrefixes:
      - example
  providerRef:
    name: example-guarddutymalwareprotectionplan
    region: us-east-1
  role: example
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`actions`	object	—	Specifies the action that is to be applied to the Malware Protection plan resource.
`actions.tagging`	object	—	Contains information about tagging status of the Malware Protection plan resource.
`actions.tagging.status`	string	—	Indicates whether or not you chose GuardDuty to add a predefined tag to the scanned S3 object.
`protectedResource`	object	yes	Information about the protected resource.
`protectedResource.s3Bucket`	object	yes	Information about the protected S3 bucket resource.
`protectedResource.s3Bucket.bucketName`	string	—	Name of the S3 bucket.
`protectedResource.s3Bucket.objectPrefixes`	array<string>	—	Information about the specified object prefixes.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`role`	string	yes	IAM role that includes the permissions required to scan and (optionally) add tags to the associated protected resource.
`tags`	array<object>	—	The tags to be added to the created Malware Protection plan resource.
`tags[].key`	string	yes
`tags[].value`	string	yes

Status

Field	Type	Required	Description
`arn`	string	—	Amazon Resource Name (ARN) of the protected resource.
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`createdAt`	string	—	The timestamp when the Malware Protection plan resource was created.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`malwareProtectionPlanId`	string	—	A unique identifier associated with Malware Protection plan resource.
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`status`	string	—	Status of the Malware Protection plan resource.
`statusReasons`	array<object>	—	Status details associated with the Malware Protection plan resource status.
`statusReasons[].code`	string	—	The status code of the Malware Protection plan.
`statusReasons[].message`	string	—	Issue message that specifies the reason.

GuardDutyMaster # CLOUD CONTROL · AWS::GuardDuty::Master ⚠ DESTRUCTIVE SCOPE

Caution, destructive scope: account-wide GuardDuty administrator relationship. Provided for completeness; do not use from application namespaces. Restrict with AWSProvider.allowedNamespaces and RBAC. GuardDutyMaster manages AWS::GuardDuty::Master through the AWS Cloud Control API.

kubectl get guarddutymasters · example on GitHub

Example

# GuardDutyMaster — GuardDuty
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/guardduty.html#guarddutymaster
apiVersion: aws.konfig.io/v1alpha1
kind: GuardDutyMaster
metadata:
  name: example-guarddutymaster
  namespace: default
spec:
  detectorId: example-id
  masterId: example-id
  providerRef:
    name: example-guarddutymaster
    region: us-east-1

Spec

Field	Type	Required	Description
`detectorId`	string	yes	Unique ID of the detector of the GuardDuty member account.
`invitationId`	string	—	Value used to validate the master account to the member account.
`masterId`	string	yes	ID of the account used as the master account.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

GuardDutyMember # CLOUD CONTROL · AWS::GuardDuty::Member

GuardDutyMember manages AWS::GuardDuty::Member through the AWS Cloud Control API.

kubectl get guarddutymembers · example on GitHub

Example

# GuardDutyMember — GuardDuty
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/guardduty.html#guarddutymember
apiVersion: aws.konfig.io/v1alpha1
kind: GuardDutyMember
metadata:
  name: example-guarddutymember
  namespace: default
spec:
  disableEmailNotification: false
  email: ops@example.com
  message: example
  providerRef:
    name: example-guarddutymember
    region: us-east-1
  status: example

Spec

Field	Type	Required	Description
`detectorId`	string	—	Create-only in AWS: changing it requires replacing the resource.
`disableEmailNotification`	boolean	—
`email`	string	yes
`memberId`	string	—	Create-only in AWS: changing it requires replacing the resource.
`message`	string	—
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`status`	string	—

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

GuardDutyPublishingDestination # CLOUD CONTROL · AWS::GuardDuty::PublishingDestination

GuardDutyPublishingDestination manages AWS::GuardDuty::PublishingDestination through the AWS Cloud Control API.

kubectl get guarddutypublishingdestinations · example on GitHub

Example

# GuardDutyPublishingDestination — GuardDuty
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/guardduty.html#guarddutypublishingdestination
apiVersion: aws.konfig.io/v1alpha1
kind: GuardDutyPublishingDestination
metadata:
  name: example-guarddutypublishingdestination
  namespace: default
spec:
  destinationProperties:
    destinationArn: arn:aws:iam::123456789012:role/example-role
    kmsKeyArn: arn:aws:iam::123456789012:role/example-role
  destinationType: example
  detectorId: example-id
  providerRef:
    name: example-guarddutypublishingdestination
    region: us-east-1
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`destinationProperties`	object	yes	GuardDutyPublishingDestinationCFNDestinationProperties is a nested property type of AWS::GuardDuty::PublishingDestination.
`destinationProperties.destinationArn`	string	—	The ARN of the resource to publish to.
`destinationProperties.kmsKeyArn`	string	—	The ARN of the KMS key to use for encryption.
`destinationType`	string	yes	The type of resource for the publishing destination.
`detectorId`	string	yes	The ID of the GuardDuty detector associated with the publishing destination.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	array<object>	—
`tags[].key`	string	yes
`tags[].value`	string	yes

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`id`	string	—	The ID of the publishing destination.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`publishingFailureStartTimestamp`	string	—	The time, in epoch millisecond format, at which GuardDuty was first unable to publish findings to the destination.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`status`	string	—	The status of the publishing destination.

GuardDutyThreatEntitySet # CLOUD CONTROL · AWS::GuardDuty::ThreatEntitySet

GuardDutyThreatEntitySet manages AWS::GuardDuty::ThreatEntitySet through the AWS Cloud Control API.

kubectl get guarddutythreatentitysets · example on GitHub

Example

# GuardDutyThreatEntitySet — GuardDuty
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/guardduty.html#guarddutythreatentityset
apiVersion: aws.konfig.io/v1alpha1
kind: GuardDutyThreatEntitySet
metadata:
  name: example-guarddutythreatentityset
  namespace: default
spec:
  activate: false
  expectedBucketOwner: example
  format: example
  location: example
  name: example-guarddutythreatentityset
  providerRef:
    name: example-guarddutythreatentityset
    region: us-east-1
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`activate`	boolean	—
`detectorId`	string	—	Create-only in AWS: changing it requires replacing the resource.
`expectedBucketOwner`	string	—
`format`	string	yes	Create-only in AWS: changing it requires replacing the resource.
`location`	string	yes
`name`	string	—
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	array<object>	—
`tags[].key`	string	yes
`tags[].value`	string	yes

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`createdAt`	string	—	Read-only: reported by AWS after creation.
`errorDetails`	string	—	Read-only: reported by AWS after creation.
`id`	string	—	Read-only: reported by AWS after creation.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`status`	enum	—	Read-only: reported by AWS after creation. Allowed: `INACTIVE, ACTIVATING, ACTIVE, DEACTIVATING, ERROR, DELETE_PENDING, DELETED`
`updatedAt`	string	—	Read-only: reported by AWS after creation.

GuardDutyThreatIntelSet # CLOUD CONTROL · AWS::GuardDuty::ThreatIntelSet

GuardDutyThreatIntelSet manages AWS::GuardDuty::ThreatIntelSet through the AWS Cloud Control API.

kubectl get guarddutythreatintelsets · example on GitHub

Example

# GuardDutyThreatIntelSet — GuardDuty
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/guardduty.html#guarddutythreatintelset
apiVersion: aws.konfig.io/v1alpha1
kind: GuardDutyThreatIntelSet
metadata:
  name: example-guarddutythreatintelset
  namespace: default
spec:
  activate: false
  expectedBucketOwner: example
  format: example
  location: example
  name: example-guarddutythreatintelset
  providerRef:
    name: example-guarddutythreatintelset
    region: us-east-1
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`activate`	boolean	—
`detectorId`	string	—	Create-only in AWS: changing it requires replacing the resource.
`expectedBucketOwner`	string	—
`format`	string	yes	Create-only in AWS: changing it requires replacing the resource.
`location`	string	yes
`name`	string	—
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	array<object>	—
`tags[].key`	string	yes
`tags[].value`	string	yes

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`id`	string	—	Read-only: reported by AWS after creation.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

GuardDutyTrustedEntitySet # CLOUD CONTROL · AWS::GuardDuty::TrustedEntitySet

GuardDutyTrustedEntitySet manages AWS::GuardDuty::TrustedEntitySet through the AWS Cloud Control API.

kubectl get guarddutytrustedentitysets · example on GitHub

Example

# GuardDutyTrustedEntitySet — GuardDuty
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/guardduty.html#guarddutytrustedentityset
apiVersion: aws.konfig.io/v1alpha1
kind: GuardDutyTrustedEntitySet
metadata:
  name: example-guarddutytrustedentityset
  namespace: default
spec:
  activate: false
  expectedBucketOwner: example
  format: example
  location: example
  name: example-guarddutytrustedentityset
  providerRef:
    name: example-guarddutytrustedentityset
    region: us-east-1
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`activate`	boolean	—
`detectorId`	string	—	Create-only in AWS: changing it requires replacing the resource.
`expectedBucketOwner`	string	—
`format`	string	yes	Create-only in AWS: changing it requires replacing the resource.
`location`	string	yes
`name`	string	—
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	array<object>	—
`tags[].key`	string	yes
`tags[].value`	string	yes

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`createdAt`	string	—	Read-only: reported by AWS after creation.
`errorDetails`	string	—	Read-only: reported by AWS after creation.
`id`	string	—	Read-only: reported by AWS after creation.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`status`	enum	—	Read-only: reported by AWS after creation. Allowed: `INACTIVE, ACTIVATING, ACTIVE, DEACTIVATING, ERROR, DELETE_PENDING, DELETED`
`updatedAt`	string	—	Read-only: reported by AWS after creation.