Docs Home Pulumi IaC Pulumi ESC Pulumi Cloud Packages Tutorials
  1. Packages
  2. AWS Cloud Control
  3. API Docs
  4. guardduty
  5. Filter

We recommend new projects start with resources from the AWS provider.

AWS Cloud Control v1.26.0 published on Wednesday, Mar 12, 2025 by Pulumi
pulumi/pulumi-aws-native

aws-native.guardduty.Filter

Explore with Pulumi AI

aws-native logo

We recommend new projects start with resources from the AWS provider.

AWS Cloud Control v1.26.0 published on Wednesday, Mar 12, 2025 by Pulumi
pulumi/pulumi-aws-native

    Resource Type definition for AWS::GuardDuty::Filter

    Create Filter Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new Filter(name: string, args: FilterArgs, opts?: CustomResourceOptions);
    @overload
def Filter(resource_name: str,
           args: FilterArgs,
           opts: Optional[ResourceOptions] = None)

@overload
def Filter(resource_name: str,
           opts: Optional[ResourceOptions] = None,
           detector_id: Optional[str] = None,
           finding_criteria: Optional[FilterFindingCriteriaArgs] = None,
           action: Optional[str] = None,
           description: Optional[str] = None,
           name: Optional[str] = None,
           rank: Optional[int] = None,
           tags: Optional[Sequence[_root_inputs.TagArgs]] = None)
    func NewFilter(ctx *Context, name string, args FilterArgs, opts ...ResourceOption) (*Filter, error)
    public Filter(string name, FilterArgs args, CustomResourceOptions? opts = null)
    public Filter(String name, FilterArgs args)
public Filter(String name, FilterArgs args, CustomResourceOptions options)

    type: aws-native:guardduty:Filter
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

    Parameters

    name string
    The unique name of the resource.
    args FilterArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args FilterArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args FilterArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args FilterArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args FilterArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Filter Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The Filter resource accepts the following input properties:

    DetectorId string

    The detector ID associated with the GuardDuty account for which you want to create a filter.

    To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API.

    FindingCriteria Pulumi.AwsNative.GuardDuty.Inputs.FilterFindingCriteria
    Represents the criteria to be used in the filter for querying findings.
    Action string
    Specifies the action that is to be applied to the findings that match the filter.
    Description string
    The description of the filter. Valid characters include alphanumeric characters, and special characters such as hyphen, period, colon, underscore, parentheses ( { } , [ ] , and ( ) ), forward slash, horizontal tab, vertical tab, newline, form feed, return, and whitespace.
    Name string
    The name of the filter. Valid characters include period (.), underscore (_), dash (-), and alphanumeric characters. A whitespace is considered to be an invalid character.
    Rank int

    Specifies the position of the filter in the list of current filters. Also specifies the order in which this filter is applied to the findings. The minimum value for this property is 1 and the maximum is 100.

    By default, filters may not be created in the same order as they are ranked. To ensure that the filters are created in the expected order, you can use an optional attribute, DependsOn , with the following syntax: "DependsOn":[ "ObjectName" ] .

    Tags List<Pulumi.AwsNative.Inputs.Tag>

    The tags to be added to a new filter resource. Each tag consists of a key and an optional value, both of which you define.

    For more information, see Tag .

    DetectorId string

    The detector ID associated with the GuardDuty account for which you want to create a filter.

    To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API.

    FindingCriteria FilterFindingCriteriaArgs
    Represents the criteria to be used in the filter for querying findings.
    Action string
    Specifies the action that is to be applied to the findings that match the filter.
    Description string
    The description of the filter. Valid characters include alphanumeric characters, and special characters such as hyphen, period, colon, underscore, parentheses ( { } , [ ] , and ( ) ), forward slash, horizontal tab, vertical tab, newline, form feed, return, and whitespace.
    Name string
    The name of the filter. Valid characters include period (.), underscore (_), dash (-), and alphanumeric characters. A whitespace is considered to be an invalid character.
    Rank int

    Specifies the position of the filter in the list of current filters. Also specifies the order in which this filter is applied to the findings. The minimum value for this property is 1 and the maximum is 100.

    By default, filters may not be created in the same order as they are ranked. To ensure that the filters are created in the expected order, you can use an optional attribute, DependsOn , with the following syntax: "DependsOn":[ "ObjectName" ] .

    Tags TagArgs

    The tags to be added to a new filter resource. Each tag consists of a key and an optional value, both of which you define.

    For more information, see Tag .

    detectorId String

    The detector ID associated with the GuardDuty account for which you want to create a filter.

    To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API.

    findingCriteria FilterFindingCriteria
    Represents the criteria to be used in the filter for querying findings.
    action String
    Specifies the action that is to be applied to the findings that match the filter.
    description String
    The description of the filter. Valid characters include alphanumeric characters, and special characters such as hyphen, period, colon, underscore, parentheses ( { } , [ ] , and ( ) ), forward slash, horizontal tab, vertical tab, newline, form feed, return, and whitespace.
    name String
    The name of the filter. Valid characters include period (.), underscore (_), dash (-), and alphanumeric characters. A whitespace is considered to be an invalid character.
    rank Integer

    Specifies the position of the filter in the list of current filters. Also specifies the order in which this filter is applied to the findings. The minimum value for this property is 1 and the maximum is 100.

    By default, filters may not be created in the same order as they are ranked. To ensure that the filters are created in the expected order, you can use an optional attribute, DependsOn , with the following syntax: "DependsOn":[ "ObjectName" ] .

    tags List<Tag>

    The tags to be added to a new filter resource. Each tag consists of a key and an optional value, both of which you define.

    For more information, see Tag .

    detectorId string

    The detector ID associated with the GuardDuty account for which you want to create a filter.

    To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API.

    findingCriteria FilterFindingCriteria
    Represents the criteria to be used in the filter for querying findings.
    action string
    Specifies the action that is to be applied to the findings that match the filter.
    description string
    The description of the filter. Valid characters include alphanumeric characters, and special characters such as hyphen, period, colon, underscore, parentheses ( { } , [ ] , and ( ) ), forward slash, horizontal tab, vertical tab, newline, form feed, return, and whitespace.
    name string
    The name of the filter. Valid characters include period (.), underscore (_), dash (-), and alphanumeric characters. A whitespace is considered to be an invalid character.
    rank number

    Specifies the position of the filter in the list of current filters. Also specifies the order in which this filter is applied to the findings. The minimum value for this property is 1 and the maximum is 100.

    By default, filters may not be created in the same order as they are ranked. To ensure that the filters are created in the expected order, you can use an optional attribute, DependsOn , with the following syntax: "DependsOn":[ "ObjectName" ] .

    tags Tag[]

    The tags to be added to a new filter resource. Each tag consists of a key and an optional value, both of which you define.

    For more information, see Tag .

    detector_id str

    The detector ID associated with the GuardDuty account for which you want to create a filter.

    To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API.

    finding_criteria FilterFindingCriteriaArgs
    Represents the criteria to be used in the filter for querying findings.
    action str
    Specifies the action that is to be applied to the findings that match the filter.
    description str
    The description of the filter. Valid characters include alphanumeric characters, and special characters such as hyphen, period, colon, underscore, parentheses ( { } , [ ] , and ( ) ), forward slash, horizontal tab, vertical tab, newline, form feed, return, and whitespace.
    name str
    The name of the filter. Valid characters include period (.), underscore (_), dash (-), and alphanumeric characters. A whitespace is considered to be an invalid character.
    rank int

    Specifies the position of the filter in the list of current filters. Also specifies the order in which this filter is applied to the findings. The minimum value for this property is 1 and the maximum is 100.

    By default, filters may not be created in the same order as they are ranked. To ensure that the filters are created in the expected order, you can use an optional attribute, DependsOn , with the following syntax: "DependsOn":[ "ObjectName" ] .

    tags Sequence[TagArgs]

    The tags to be added to a new filter resource. Each tag consists of a key and an optional value, both of which you define.

    For more information, see Tag .

    detectorId String

    The detector ID associated with the GuardDuty account for which you want to create a filter.

    To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API.

    findingCriteria Property Map
    Represents the criteria to be used in the filter for querying findings.
    action String
    Specifies the action that is to be applied to the findings that match the filter.
    description String
    The description of the filter. Valid characters include alphanumeric characters, and special characters such as hyphen, period, colon, underscore, parentheses ( { } , [ ] , and ( ) ), forward slash, horizontal tab, vertical tab, newline, form feed, return, and whitespace.
    name String
    The name of the filter. Valid characters include period (.), underscore (_), dash (-), and alphanumeric characters. A whitespace is considered to be an invalid character.
    rank Number

    Specifies the position of the filter in the list of current filters. Also specifies the order in which this filter is applied to the findings. The minimum value for this property is 1 and the maximum is 100.

    By default, filters may not be created in the same order as they are ranked. To ensure that the filters are created in the expected order, you can use an optional attribute, DependsOn , with the following syntax: "DependsOn":[ "ObjectName" ] .

    tags List<Property Map>

    The tags to be added to a new filter resource. Each tag consists of a key and an optional value, both of which you define.

    For more information, see Tag .

    Outputs

    All input properties are implicitly available as output properties. Additionally, the Filter resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    Id string
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.
    id string
    The provider-assigned unique ID for this managed resource.
    id str
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.

    Supporting Types

    FilterCondition, FilterConditionArgs

    Eq List<string>
    Equals List<string>
    GreaterThan int
    GreaterThanOrEqual int
    Gt int
    Gte int
    LessThan int
    LessThanOrEqual int
    Lt int
    Lte int
    Neq List<string>
    NotEquals List<string>
    Eq []string
    Equals []string
    GreaterThan int
    GreaterThanOrEqual int
    Gt int
    Gte int
    LessThan int
    LessThanOrEqual int
    Lt int
    Lte int
    Neq []string
    NotEquals []string
    eq List<String>
    equals_ List<String>
    greaterThan Integer
    greaterThanOrEqual Integer
    gt Integer
    gte Integer
    lessThan Integer
    lessThanOrEqual Integer
    lt Integer
    lte Integer
    neq List<String>
    notEquals List<String>
    eq string[]
    equals string[]
    greaterThan number
    greaterThanOrEqual number
    gt number
    gte number
    lessThan number
    lessThanOrEqual number
    lt number
    lte number
    neq string[]
    notEquals string[]
    eq Sequence[str]
    equals Sequence[str]
    greater_than int
    greater_than_or_equal int
    gt int
    gte int
    less_than int
    less_than_or_equal int
    lt int
    lte int
    neq Sequence[str]
    not_equals Sequence[str]
    eq List<String>
    equals List<String>
    greaterThan Number
    greaterThanOrEqual Number
    gt Number
    gte Number
    lessThan Number
    lessThanOrEqual Number
    lt Number
    lte Number
    neq List<String>
    notEquals List<String>

    FilterFindingCriteria, FilterFindingCriteriaArgs

    Criterion Dictionary<string, Pulumi.AwsNative.GuardDuty.Inputs.FilterCondition>

    Represents a map of finding properties that match specified conditions and values when querying findings.

    For information about JSON criterion mapping to their console equivalent, see Finding criteria . The following are the available criterion:

    • accountId
    • id
    • region
    • severity

    To filter on the basis of severity, the API and AWS CLI use the following input list for the FindingCriteria condition:

    • Low : ["1", "2", "3"]
    • Medium : ["4", "5", "6"]
    • High : ["7", "8", "9"]

    For more information, see Severity levels for GuardDuty findings in the Amazon GuardDuty User Guide .

    • type
    • updatedAt

    Type: ISO 8601 string format: YYYY-MM-DDTHH:MM:SS.SSSZ or YYYY-MM-DDTHH:MM:SSZ depending on whether the value contains milliseconds.

    • resource.accessKeyDetails.accessKeyId
    • resource.accessKeyDetails.principalId
    • resource.accessKeyDetails.userName
    • resource.accessKeyDetails.userType
    • resource.instanceDetails.iamInstanceProfile.id
    • resource.instanceDetails.imageId
    • resource.instanceDetails.instanceId
    • resource.instanceDetails.tags.key
    • resource.instanceDetails.tags.value
    • resource.instanceDetails.networkInterfaces.ipv6Addresses
    • resource.instanceDetails.networkInterfaces.privateIpAddresses.privateIpAddress
    • resource.instanceDetails.networkInterfaces.publicDnsName
    • resource.instanceDetails.networkInterfaces.publicIp
    • resource.instanceDetails.networkInterfaces.securityGroups.groupId
    • resource.instanceDetails.networkInterfaces.securityGroups.groupName
    • resource.instanceDetails.networkInterfaces.subnetId
    • resource.instanceDetails.networkInterfaces.vpcId
    • resource.instanceDetails.outpostArn
    • resource.resourceType
    • resource.s3BucketDetails.publicAccess.effectivePermissions
    • resource.s3BucketDetails.name
    • resource.s3BucketDetails.tags.key
    • resource.s3BucketDetails.tags.value
    • resource.s3BucketDetails.type
    • service.action.actionType
    • service.action.awsApiCallAction.api
    • service.action.awsApiCallAction.callerType
    • service.action.awsApiCallAction.errorCode
    • service.action.awsApiCallAction.remoteIpDetails.city.cityName
    • service.action.awsApiCallAction.remoteIpDetails.country.countryName
    • service.action.awsApiCallAction.remoteIpDetails.ipAddressV4
    • service.action.awsApiCallAction.remoteIpDetails.ipAddressV6
    • service.action.awsApiCallAction.remoteIpDetails.organization.asn
    • service.action.awsApiCallAction.remoteIpDetails.organization.asnOrg
    • service.action.awsApiCallAction.serviceName
    • service.action.dnsRequestAction.domain
    • service.action.dnsRequestAction.domainWithSuffix
    • service.action.networkConnectionAction.blocked
    • service.action.networkConnectionAction.connectionDirection
    • service.action.networkConnectionAction.localPortDetails.port
    • service.action.networkConnectionAction.protocol
    • service.action.networkConnectionAction.remoteIpDetails.city.cityName
    • service.action.networkConnectionAction.remoteIpDetails.country.countryName
    • service.action.networkConnectionAction.remoteIpDetails.ipAddressV4
    • service.action.networkConnectionAction.remoteIpDetails.ipAddressV6
    • service.action.networkConnectionAction.remoteIpDetails.organization.asn
    • service.action.networkConnectionAction.remoteIpDetails.organization.asnOrg
    • service.action.networkConnectionAction.remotePortDetails.port
    • service.action.awsApiCallAction.remoteAccountDetails.affiliated
    • service.action.kubernetesApiCallAction.remoteIpDetails.ipAddressV4
    • service.action.kubernetesApiCallAction.remoteIpDetails.ipAddressV6
    • service.action.kubernetesApiCallAction.namespace
    • service.action.kubernetesApiCallAction.remoteIpDetails.organization.asn
    • service.action.kubernetesApiCallAction.requestUri
    • service.action.kubernetesApiCallAction.statusCode
    • service.action.networkConnectionAction.localIpDetails.ipAddressV4
    • service.action.networkConnectionAction.localIpDetails.ipAddressV6
    • service.action.networkConnectionAction.protocol
    • service.action.awsApiCallAction.serviceName
    • service.action.awsApiCallAction.remoteAccountDetails.accountId
    • service.additionalInfo.threatListName
    • service.resourceRole
    • resource.eksClusterDetails.name
    • resource.kubernetesDetails.kubernetesWorkloadDetails.name
    • resource.kubernetesDetails.kubernetesWorkloadDetails.namespace
    • resource.kubernetesDetails.kubernetesUserDetails.username
    • resource.kubernetesDetails.kubernetesWorkloadDetails.containers.image
    • resource.kubernetesDetails.kubernetesWorkloadDetails.containers.imagePrefix
    • service.ebsVolumeScanDetails.scanId
    • service.ebsVolumeScanDetails.scanDetections.threatDetectedByName.threatNames.name
    • service.ebsVolumeScanDetails.scanDetections.threatDetectedByName.threatNames.severity
    • service.ebsVolumeScanDetails.scanDetections.threatDetectedByName.threatNames.filePaths.hash
    • service.malwareScanDetails.threats.name
    • resource.ecsClusterDetails.name
    • resource.ecsClusterDetails.taskDetails.containers.image
    • resource.ecsClusterDetails.taskDetails.definitionArn
    • resource.containerDetails.image
    • resource.rdsDbInstanceDetails.dbInstanceIdentifier
    • resource.rdsDbInstanceDetails.dbClusterIdentifier
    • resource.rdsDbInstanceDetails.engine
    • resource.rdsDbUserDetails.user
    • resource.rdsDbInstanceDetails.tags.key
    • resource.rdsDbInstanceDetails.tags.value
    • service.runtimeDetails.process.executableSha256
    • service.runtimeDetails.process.name
    • service.runtimeDetails.process.name
    • resource.lambdaDetails.functionName
    • resource.lambdaDetails.functionArn
    • resource.lambdaDetails.tags.key
    • resource.lambdaDetails.tags.value
    Criterion map[string]FilterCondition

    Represents a map of finding properties that match specified conditions and values when querying findings.

    For information about JSON criterion mapping to their console equivalent, see Finding criteria . The following are the available criterion:

    • accountId
    • id
    • region
    • severity

    To filter on the basis of severity, the API and AWS CLI use the following input list for the FindingCriteria condition:

    • Low : ["1", "2", "3"]
    • Medium : ["4", "5", "6"]
    • High : ["7", "8", "9"]

    For more information, see Severity levels for GuardDuty findings in the Amazon GuardDuty User Guide .

    • type
    • updatedAt

    Type: ISO 8601 string format: YYYY-MM-DDTHH:MM:SS.SSSZ or YYYY-MM-DDTHH:MM:SSZ depending on whether the value contains milliseconds.

    • resource.accessKeyDetails.accessKeyId
    • resource.accessKeyDetails.principalId
    • resource.accessKeyDetails.userName
    • resource.accessKeyDetails.userType
    • resource.instanceDetails.iamInstanceProfile.id
    • resource.instanceDetails.imageId
    • resource.instanceDetails.instanceId
    • resource.instanceDetails.tags.key
    • resource.instanceDetails.tags.value
    • resource.instanceDetails.networkInterfaces.ipv6Addresses
    • resource.instanceDetails.networkInterfaces.privateIpAddresses.privateIpAddress
    • resource.instanceDetails.networkInterfaces.publicDnsName
    • resource.instanceDetails.networkInterfaces.publicIp
    • resource.instanceDetails.networkInterfaces.securityGroups.groupId
    • resource.instanceDetails.networkInterfaces.securityGroups.groupName
    • resource.instanceDetails.networkInterfaces.subnetId
    • resource.instanceDetails.networkInterfaces.vpcId
    • resource.instanceDetails.outpostArn
    • resource.resourceType
    • resource.s3BucketDetails.publicAccess.effectivePermissions
    • resource.s3BucketDetails.name
    • resource.s3BucketDetails.tags.key
    • resource.s3BucketDetails.tags.value
    • resource.s3BucketDetails.type
    • service.action.actionType
    • service.action.awsApiCallAction.api
    • service.action.awsApiCallAction.callerType
    • service.action.awsApiCallAction.errorCode
    • service.action.awsApiCallAction.remoteIpDetails.city.cityName
    • service.action.awsApiCallAction.remoteIpDetails.country.countryName
    • service.action.awsApiCallAction.remoteIpDetails.ipAddressV4
    • service.action.awsApiCallAction.remoteIpDetails.ipAddressV6
    • service.action.awsApiCallAction.remoteIpDetails.organization.asn
    • service.action.awsApiCallAction.remoteIpDetails.organization.asnOrg
    • service.action.awsApiCallAction.serviceName
    • service.action.dnsRequestAction.domain
    • service.action.dnsRequestAction.domainWithSuffix
    • service.action.networkConnectionAction.blocked
    • service.action.networkConnectionAction.connectionDirection
    • service.action.networkConnectionAction.localPortDetails.port
    • service.action.networkConnectionAction.protocol
    • service.action.networkConnectionAction.remoteIpDetails.city.cityName
    • service.action.networkConnectionAction.remoteIpDetails.country.countryName
    • service.action.networkConnectionAction.remoteIpDetails.ipAddressV4
    • service.action.networkConnectionAction.remoteIpDetails.ipAddressV6
    • service.action.networkConnectionAction.remoteIpDetails.organization.asn
    • service.action.networkConnectionAction.remoteIpDetails.organization.asnOrg
    • service.action.networkConnectionAction.remotePortDetails.port
    • service.action.awsApiCallAction.remoteAccountDetails.affiliated
    • service.action.kubernetesApiCallAction.remoteIpDetails.ipAddressV4
    • service.action.kubernetesApiCallAction.remoteIpDetails.ipAddressV6
    • service.action.kubernetesApiCallAction.namespace
    • service.action.kubernetesApiCallAction.remoteIpDetails.organization.asn
    • service.action.kubernetesApiCallAction.requestUri
    • service.action.kubernetesApiCallAction.statusCode
    • service.action.networkConnectionAction.localIpDetails.ipAddressV4
    • service.action.networkConnectionAction.localIpDetails.ipAddressV6
    • service.action.networkConnectionAction.protocol
    • service.action.awsApiCallAction.serviceName
    • service.action.awsApiCallAction.remoteAccountDetails.accountId
    • service.additionalInfo.threatListName
    • service.resourceRole
    • resource.eksClusterDetails.name
    • resource.kubernetesDetails.kubernetesWorkloadDetails.name
    • resource.kubernetesDetails.kubernetesWorkloadDetails.namespace
    • resource.kubernetesDetails.kubernetesUserDetails.username
    • resource.kubernetesDetails.kubernetesWorkloadDetails.containers.image
    • resource.kubernetesDetails.kubernetesWorkloadDetails.containers.imagePrefix
    • service.ebsVolumeScanDetails.scanId
    • service.ebsVolumeScanDetails.scanDetections.threatDetectedByName.threatNames.name
    • service.ebsVolumeScanDetails.scanDetections.threatDetectedByName.threatNames.severity
    • service.ebsVolumeScanDetails.scanDetections.threatDetectedByName.threatNames.filePaths.hash
    • service.malwareScanDetails.threats.name
    • resource.ecsClusterDetails.name
    • resource.ecsClusterDetails.taskDetails.containers.image
    • resource.ecsClusterDetails.taskDetails.definitionArn
    • resource.containerDetails.image
    • resource.rdsDbInstanceDetails.dbInstanceIdentifier
    • resource.rdsDbInstanceDetails.dbClusterIdentifier
    • resource.rdsDbInstanceDetails.engine
    • resource.rdsDbUserDetails.user
    • resource.rdsDbInstanceDetails.tags.key
    • resource.rdsDbInstanceDetails.tags.value
    • service.runtimeDetails.process.executableSha256
    • service.runtimeDetails.process.name
    • service.runtimeDetails.process.name
    • resource.lambdaDetails.functionName
    • resource.lambdaDetails.functionArn
    • resource.lambdaDetails.tags.key
    • resource.lambdaDetails.tags.value
    criterion Map<String,FilterCondition>

    Represents a map of finding properties that match specified conditions and values when querying findings.

    For information about JSON criterion mapping to their console equivalent, see Finding criteria . The following are the available criterion:

    • accountId
    • id
    • region
    • severity

    To filter on the basis of severity, the API and AWS CLI use the following input list for the FindingCriteria condition:

    • Low : ["1", "2", "3"]
    • Medium : ["4", "5", "6"]
    • High : ["7", "8", "9"]

    For more information, see Severity levels for GuardDuty findings in the Amazon GuardDuty User Guide .

    • type
    • updatedAt

    Type: ISO 8601 string format: YYYY-MM-DDTHH:MM:SS.SSSZ or YYYY-MM-DDTHH:MM:SSZ depending on whether the value contains milliseconds.

    • resource.accessKeyDetails.accessKeyId
    • resource.accessKeyDetails.principalId
    • resource.accessKeyDetails.userName
    • resource.accessKeyDetails.userType
    • resource.instanceDetails.iamInstanceProfile.id
    • resource.instanceDetails.imageId
    • resource.instanceDetails.instanceId
    • resource.instanceDetails.tags.key
    • resource.instanceDetails.tags.value
    • resource.instanceDetails.networkInterfaces.ipv6Addresses
    • resource.instanceDetails.networkInterfaces.privateIpAddresses.privateIpAddress
    • resource.instanceDetails.networkInterfaces.publicDnsName
    • resource.instanceDetails.networkInterfaces.publicIp
    • resource.instanceDetails.networkInterfaces.securityGroups.groupId
    • resource.instanceDetails.networkInterfaces.securityGroups.groupName
    • resource.instanceDetails.networkInterfaces.subnetId
    • resource.instanceDetails.networkInterfaces.vpcId
    • resource.instanceDetails.outpostArn
    • resource.resourceType
    • resource.s3BucketDetails.publicAccess.effectivePermissions
    • resource.s3BucketDetails.name
    • resource.s3BucketDetails.tags.key
    • resource.s3BucketDetails.tags.value
    • resource.s3BucketDetails.type
    • service.action.actionType
    • service.action.awsApiCallAction.api
    • service.action.awsApiCallAction.callerType
    • service.action.awsApiCallAction.errorCode
    • service.action.awsApiCallAction.remoteIpDetails.city.cityName
    • service.action.awsApiCallAction.remoteIpDetails.country.countryName
    • service.action.awsApiCallAction.remoteIpDetails.ipAddressV4
    • service.action.awsApiCallAction.remoteIpDetails.ipAddressV6
    • service.action.awsApiCallAction.remoteIpDetails.organization.asn
    • service.action.awsApiCallAction.remoteIpDetails.organization.asnOrg
    • service.action.awsApiCallAction.serviceName
    • service.action.dnsRequestAction.domain
    • service.action.dnsRequestAction.domainWithSuffix
    • service.action.networkConnectionAction.blocked
    • service.action.networkConnectionAction.connectionDirection
    • service.action.networkConnectionAction.localPortDetails.port
    • service.action.networkConnectionAction.protocol
    • service.action.networkConnectionAction.remoteIpDetails.city.cityName
    • service.action.networkConnectionAction.remoteIpDetails.country.countryName
    • service.action.networkConnectionAction.remoteIpDetails.ipAddressV4
    • service.action.networkConnectionAction.remoteIpDetails.ipAddressV6
    • service.action.networkConnectionAction.remoteIpDetails.organization.asn
    • service.action.networkConnectionAction.remoteIpDetails.organization.asnOrg
    • service.action.networkConnectionAction.remotePortDetails.port
    • service.action.awsApiCallAction.remoteAccountDetails.affiliated
    • service.action.kubernetesApiCallAction.remoteIpDetails.ipAddressV4
    • service.action.kubernetesApiCallAction.remoteIpDetails.ipAddressV6
    • service.action.kubernetesApiCallAction.namespace
    • service.action.kubernetesApiCallAction.remoteIpDetails.organization.asn
    • service.action.kubernetesApiCallAction.requestUri
    • service.action.kubernetesApiCallAction.statusCode
    • service.action.networkConnectionAction.localIpDetails.ipAddressV4
    • service.action.networkConnectionAction.localIpDetails.ipAddressV6
    • service.action.networkConnectionAction.protocol
    • service.action.awsApiCallAction.serviceName
    • service.action.awsApiCallAction.remoteAccountDetails.accountId
    • service.additionalInfo.threatListName
    • service.resourceRole
    • resource.eksClusterDetails.name
    • resource.kubernetesDetails.kubernetesWorkloadDetails.name
    • resource.kubernetesDetails.kubernetesWorkloadDetails.namespace
    • resource.kubernetesDetails.kubernetesUserDetails.username
    • resource.kubernetesDetails.kubernetesWorkloadDetails.containers.image
    • resource.kubernetesDetails.kubernetesWorkloadDetails.containers.imagePrefix
    • service.ebsVolumeScanDetails.scanId
    • service.ebsVolumeScanDetails.scanDetections.threatDetectedByName.threatNames.name
    • service.ebsVolumeScanDetails.scanDetections.threatDetectedByName.threatNames.severity
    • service.ebsVolumeScanDetails.scanDetections.threatDetectedByName.threatNames.filePaths.hash
    • service.malwareScanDetails.threats.name
    • resource.ecsClusterDetails.name
    • resource.ecsClusterDetails.taskDetails.containers.image
    • resource.ecsClusterDetails.taskDetails.definitionArn
    • resource.containerDetails.image
    • resource.rdsDbInstanceDetails.dbInstanceIdentifier
    • resource.rdsDbInstanceDetails.dbClusterIdentifier
    • resource.rdsDbInstanceDetails.engine
    • resource.rdsDbUserDetails.user
    • resource.rdsDbInstanceDetails.tags.key
    • resource.rdsDbInstanceDetails.tags.value
    • service.runtimeDetails.process.executableSha256
    • service.runtimeDetails.process.name
    • service.runtimeDetails.process.name
    • resource.lambdaDetails.functionName
    • resource.lambdaDetails.functionArn
    • resource.lambdaDetails.tags.key
    • resource.lambdaDetails.tags.value
    criterion {[key: string]: FilterCondition}

    Represents a map of finding properties that match specified conditions and values when querying findings.

    For information about JSON criterion mapping to their console equivalent, see Finding criteria . The following are the available criterion:

    • accountId
    • id
    • region
    • severity

    To filter on the basis of severity, the API and AWS CLI use the following input list for the FindingCriteria condition:

    • Low : ["1", "2", "3"]
    • Medium : ["4", "5", "6"]
    • High : ["7", "8", "9"]

    For more information, see Severity levels for GuardDuty findings in the Amazon GuardDuty User Guide .

    • type
    • updatedAt

    Type: ISO 8601 string format: YYYY-MM-DDTHH:MM:SS.SSSZ or YYYY-MM-DDTHH:MM:SSZ depending on whether the value contains milliseconds.

    • resource.accessKeyDetails.accessKeyId
    • resource.accessKeyDetails.principalId
    • resource.accessKeyDetails.userName
    • resource.accessKeyDetails.userType
    • resource.instanceDetails.iamInstanceProfile.id
    • resource.instanceDetails.imageId
    • resource.instanceDetails.instanceId
    • resource.instanceDetails.tags.key
    • resource.instanceDetails.tags.value
    • resource.instanceDetails.networkInterfaces.ipv6Addresses
    • resource.instanceDetails.networkInterfaces.privateIpAddresses.privateIpAddress
    • resource.instanceDetails.networkInterfaces.publicDnsName
    • resource.instanceDetails.networkInterfaces.publicIp
    • resource.instanceDetails.networkInterfaces.securityGroups.groupId
    • resource.instanceDetails.networkInterfaces.securityGroups.groupName
    • resource.instanceDetails.networkInterfaces.subnetId
    • resource.instanceDetails.networkInterfaces.vpcId
    • resource.instanceDetails.outpostArn
    • resource.resourceType
    • resource.s3BucketDetails.publicAccess.effectivePermissions
    • resource.s3BucketDetails.name
    • resource.s3BucketDetails.tags.key
    • resource.s3BucketDetails.tags.value
    • resource.s3BucketDetails.type
    • service.action.actionType
    • service.action.awsApiCallAction.api
    • service.action.awsApiCallAction.callerType
    • service.action.awsApiCallAction.errorCode
    • service.action.awsApiCallAction.remoteIpDetails.city.cityName
    • service.action.awsApiCallAction.remoteIpDetails.country.countryName
    • service.action.awsApiCallAction.remoteIpDetails.ipAddressV4
    • service.action.awsApiCallAction.remoteIpDetails.ipAddressV6
    • service.action.awsApiCallAction.remoteIpDetails.organization.asn
    • service.action.awsApiCallAction.remoteIpDetails.organization.asnOrg
    • service.action.awsApiCallAction.serviceName
    • service.action.dnsRequestAction.domain
    • service.action.dnsRequestAction.domainWithSuffix
    • service.action.networkConnectionAction.blocked
    • service.action.networkConnectionAction.connectionDirection
    • service.action.networkConnectionAction.localPortDetails.port
    • service.action.networkConnectionAction.protocol
    • service.action.networkConnectionAction.remoteIpDetails.city.cityName
    • service.action.networkConnectionAction.remoteIpDetails.country.countryName
    • service.action.networkConnectionAction.remoteIpDetails.ipAddressV4
    • service.action.networkConnectionAction.remoteIpDetails.ipAddressV6
    • service.action.networkConnectionAction.remoteIpDetails.organization.asn
    • service.action.networkConnectionAction.remoteIpDetails.organization.asnOrg
    • service.action.networkConnectionAction.remotePortDetails.port
    • service.action.awsApiCallAction.remoteAccountDetails.affiliated
    • service.action.kubernetesApiCallAction.remoteIpDetails.ipAddressV4
    • service.action.kubernetesApiCallAction.remoteIpDetails.ipAddressV6
    • service.action.kubernetesApiCallAction.namespace
    • service.action.kubernetesApiCallAction.remoteIpDetails.organization.asn
    • service.action.kubernetesApiCallAction.requestUri
    • service.action.kubernetesApiCallAction.statusCode
    • service.action.networkConnectionAction.localIpDetails.ipAddressV4
    • service.action.networkConnectionAction.localIpDetails.ipAddressV6
    • service.action.networkConnectionAction.protocol
    • service.action.awsApiCallAction.serviceName
    • service.action.awsApiCallAction.remoteAccountDetails.accountId
    • service.additionalInfo.threatListName
    • service.resourceRole
    • resource.eksClusterDetails.name
    • resource.kubernetesDetails.kubernetesWorkloadDetails.name
    • resource.kubernetesDetails.kubernetesWorkloadDetails.namespace
    • resource.kubernetesDetails.kubernetesUserDetails.username
    • resource.kubernetesDetails.kubernetesWorkloadDetails.containers.image
    • resource.kubernetesDetails.kubernetesWorkloadDetails.containers.imagePrefix
    • service.ebsVolumeScanDetails.scanId
    • service.ebsVolumeScanDetails.scanDetections.threatDetectedByName.threatNames.name
    • service.ebsVolumeScanDetails.scanDetections.threatDetectedByName.threatNames.severity
    • service.ebsVolumeScanDetails.scanDetections.threatDetectedByName.threatNames.filePaths.hash
    • service.malwareScanDetails.threats.name
    • resource.ecsClusterDetails.name
    • resource.ecsClusterDetails.taskDetails.containers.image
    • resource.ecsClusterDetails.taskDetails.definitionArn
    • resource.containerDetails.image
    • resource.rdsDbInstanceDetails.dbInstanceIdentifier
    • resource.rdsDbInstanceDetails.dbClusterIdentifier
    • resource.rdsDbInstanceDetails.engine
    • resource.rdsDbUserDetails.user
    • resource.rdsDbInstanceDetails.tags.key
    • resource.rdsDbInstanceDetails.tags.value
    • service.runtimeDetails.process.executableSha256
    • service.runtimeDetails.process.name
    • service.runtimeDetails.process.name
    • resource.lambdaDetails.functionName
    • resource.lambdaDetails.functionArn
    • resource.lambdaDetails.tags.key
    • resource.lambdaDetails.tags.value
    criterion Mapping[str, FilterCondition]

    Represents a map of finding properties that match specified conditions and values when querying findings.

    For information about JSON criterion mapping to their console equivalent, see Finding criteria . The following are the available criterion:

    • accountId
    • id
    • region
    • severity

    To filter on the basis of severity, the API and AWS CLI use the following input list for the FindingCriteria condition:

    • Low : ["1", "2", "3"]
    • Medium : ["4", "5", "6"]
    • High : ["7", "8", "9"]

    For more information, see Severity levels for GuardDuty findings in the Amazon GuardDuty User Guide .

    • type
    • updatedAt

    Type: ISO 8601 string format: YYYY-MM-DDTHH:MM:SS.SSSZ or YYYY-MM-DDTHH:MM:SSZ depending on whether the value contains milliseconds.

    • resource.accessKeyDetails.accessKeyId
    • resource.accessKeyDetails.principalId
    • resource.accessKeyDetails.userName
    • resource.accessKeyDetails.userType
    • resource.instanceDetails.iamInstanceProfile.id
    • resource.instanceDetails.imageId
    • resource.instanceDetails.instanceId
    • resource.instanceDetails.tags.key
    • resource.instanceDetails.tags.value
    • resource.instanceDetails.networkInterfaces.ipv6Addresses
    • resource.instanceDetails.networkInterfaces.privateIpAddresses.privateIpAddress
    • resource.instanceDetails.networkInterfaces.publicDnsName
    • resource.instanceDetails.networkInterfaces.publicIp
    • resource.instanceDetails.networkInterfaces.securityGroups.groupId
    • resource.instanceDetails.networkInterfaces.securityGroups.groupName
    • resource.instanceDetails.networkInterfaces.subnetId
    • resource.instanceDetails.networkInterfaces.vpcId
    • resource.instanceDetails.outpostArn
    • resource.resourceType
    • resource.s3BucketDetails.publicAccess.effectivePermissions
    • resource.s3BucketDetails.name
    • resource.s3BucketDetails.tags.key
    • resource.s3BucketDetails.tags.value
    • resource.s3BucketDetails.type
    • service.action.actionType
    • service.action.awsApiCallAction.api
    • service.action.awsApiCallAction.callerType
    • service.action.awsApiCallAction.errorCode
    • service.action.awsApiCallAction.remoteIpDetails.city.cityName
    • service.action.awsApiCallAction.remoteIpDetails.country.countryName
    • service.action.awsApiCallAction.remoteIpDetails.ipAddressV4
    • service.action.awsApiCallAction.remoteIpDetails.ipAddressV6
    • service.action.awsApiCallAction.remoteIpDetails.organization.asn
    • service.action.awsApiCallAction.remoteIpDetails.organization.asnOrg
    • service.action.awsApiCallAction.serviceName
    • service.action.dnsRequestAction.domain
    • service.action.dnsRequestAction.domainWithSuffix
    • service.action.networkConnectionAction.blocked
    • service.action.networkConnectionAction.connectionDirection
    • service.action.networkConnectionAction.localPortDetails.port
    • service.action.networkConnectionAction.protocol
    • service.action.networkConnectionAction.remoteIpDetails.city.cityName
    • service.action.networkConnectionAction.remoteIpDetails.country.countryName
    • service.action.networkConnectionAction.remoteIpDetails.ipAddressV4
    • service.action.networkConnectionAction.remoteIpDetails.ipAddressV6
    • service.action.networkConnectionAction.remoteIpDetails.organization.asn
    • service.action.networkConnectionAction.remoteIpDetails.organization.asnOrg
    • service.action.networkConnectionAction.remotePortDetails.port
    • service.action.awsApiCallAction.remoteAccountDetails.affiliated
    • service.action.kubernetesApiCallAction.remoteIpDetails.ipAddressV4
    • service.action.kubernetesApiCallAction.remoteIpDetails.ipAddressV6
    • service.action.kubernetesApiCallAction.namespace
    • service.action.kubernetesApiCallAction.remoteIpDetails.organization.asn
    • service.action.kubernetesApiCallAction.requestUri
    • service.action.kubernetesApiCallAction.statusCode
    • service.action.networkConnectionAction.localIpDetails.ipAddressV4
    • service.action.networkConnectionAction.localIpDetails.ipAddressV6
    • service.action.networkConnectionAction.protocol
    • service.action.awsApiCallAction.serviceName
    • service.action.awsApiCallAction.remoteAccountDetails.accountId
    • service.additionalInfo.threatListName
    • service.resourceRole
    • resource.eksClusterDetails.name
    • resource.kubernetesDetails.kubernetesWorkloadDetails.name
    • resource.kubernetesDetails.kubernetesWorkloadDetails.namespace
    • resource.kubernetesDetails.kubernetesUserDetails.username
    • resource.kubernetesDetails.kubernetesWorkloadDetails.containers.image
    • resource.kubernetesDetails.kubernetesWorkloadDetails.containers.imagePrefix
    • service.ebsVolumeScanDetails.scanId
    • service.ebsVolumeScanDetails.scanDetections.threatDetectedByName.threatNames.name
    • service.ebsVolumeScanDetails.scanDetections.threatDetectedByName.threatNames.severity
    • service.ebsVolumeScanDetails.scanDetections.threatDetectedByName.threatNames.filePaths.hash
    • service.malwareScanDetails.threats.name
    • resource.ecsClusterDetails.name
    • resource.ecsClusterDetails.taskDetails.containers.image
    • resource.ecsClusterDetails.taskDetails.definitionArn
    • resource.containerDetails.image
    • resource.rdsDbInstanceDetails.dbInstanceIdentifier
    • resource.rdsDbInstanceDetails.dbClusterIdentifier
    • resource.rdsDbInstanceDetails.engine
    • resource.rdsDbUserDetails.user
    • resource.rdsDbInstanceDetails.tags.key
    • resource.rdsDbInstanceDetails.tags.value
    • service.runtimeDetails.process.executableSha256
    • service.runtimeDetails.process.name
    • service.runtimeDetails.process.name
    • resource.lambdaDetails.functionName
    • resource.lambdaDetails.functionArn
    • resource.lambdaDetails.tags.key
    • resource.lambdaDetails.tags.value
    criterion Map<Property Map>

    Represents a map of finding properties that match specified conditions and values when querying findings.

    For information about JSON criterion mapping to their console equivalent, see Finding criteria . The following are the available criterion:

    • accountId
    • id
    • region
    • severity

    To filter on the basis of severity, the API and AWS CLI use the following input list for the FindingCriteria condition:

    • Low : ["1", "2", "3"]
    • Medium : ["4", "5", "6"]
    • High : ["7", "8", "9"]

    For more information, see Severity levels for GuardDuty findings in the Amazon GuardDuty User Guide .

    • type
    • updatedAt

    Type: ISO 8601 string format: YYYY-MM-DDTHH:MM:SS.SSSZ or YYYY-MM-DDTHH:MM:SSZ depending on whether the value contains milliseconds.

    • resource.accessKeyDetails.accessKeyId
    • resource.accessKeyDetails.principalId
    • resource.accessKeyDetails.userName
    • resource.accessKeyDetails.userType
    • resource.instanceDetails.iamInstanceProfile.id
    • resource.instanceDetails.imageId
    • resource.instanceDetails.instanceId
    • resource.instanceDetails.tags.key
    • resource.instanceDetails.tags.value
    • resource.instanceDetails.networkInterfaces.ipv6Addresses
    • resource.instanceDetails.networkInterfaces.privateIpAddresses.privateIpAddress
    • resource.instanceDetails.networkInterfaces.publicDnsName
    • resource.instanceDetails.networkInterfaces.publicIp
    • resource.instanceDetails.networkInterfaces.securityGroups.groupId
    • resource.instanceDetails.networkInterfaces.securityGroups.groupName
    • resource.instanceDetails.networkInterfaces.subnetId
    • resource.instanceDetails.networkInterfaces.vpcId
    • resource.instanceDetails.outpostArn
    • resource.resourceType
    • resource.s3BucketDetails.publicAccess.effectivePermissions
    • resource.s3BucketDetails.name
    • resource.s3BucketDetails.tags.key
    • resource.s3BucketDetails.tags.value
    • resource.s3BucketDetails.type
    • service.action.actionType
    • service.action.awsApiCallAction.api
    • service.action.awsApiCallAction.callerType
    • service.action.awsApiCallAction.errorCode
    • service.action.awsApiCallAction.remoteIpDetails.city.cityName
    • service.action.awsApiCallAction.remoteIpDetails.country.countryName
    • service.action.awsApiCallAction.remoteIpDetails.ipAddressV4
    • service.action.awsApiCallAction.remoteIpDetails.ipAddressV6
    • service.action.awsApiCallAction.remoteIpDetails.organization.asn
    • service.action.awsApiCallAction.remoteIpDetails.organization.asnOrg
    • service.action.awsApiCallAction.serviceName
    • service.action.dnsRequestAction.domain
    • service.action.dnsRequestAction.domainWithSuffix
    • service.action.networkConnectionAction.blocked
    • service.action.networkConnectionAction.connectionDirection
    • service.action.networkConnectionAction.localPortDetails.port
    • service.action.networkConnectionAction.protocol
    • service.action.networkConnectionAction.remoteIpDetails.city.cityName
    • service.action.networkConnectionAction.remoteIpDetails.country.countryName
    • service.action.networkConnectionAction.remoteIpDetails.ipAddressV4
    • service.action.networkConnectionAction.remoteIpDetails.ipAddressV6
    • service.action.networkConnectionAction.remoteIpDetails.organization.asn
    • service.action.networkConnectionAction.remoteIpDetails.organization.asnOrg
    • service.action.networkConnectionAction.remotePortDetails.port
    • service.action.awsApiCallAction.remoteAccountDetails.affiliated
    • service.action.kubernetesApiCallAction.remoteIpDetails.ipAddressV4
    • service.action.kubernetesApiCallAction.remoteIpDetails.ipAddressV6
    • service.action.kubernetesApiCallAction.namespace
    • service.action.kubernetesApiCallAction.remoteIpDetails.organization.asn
    • service.action.kubernetesApiCallAction.requestUri
    • service.action.kubernetesApiCallAction.statusCode
    • service.action.networkConnectionAction.localIpDetails.ipAddressV4
    • service.action.networkConnectionAction.localIpDetails.ipAddressV6
    • service.action.networkConnectionAction.protocol
    • service.action.awsApiCallAction.serviceName
    • service.action.awsApiCallAction.remoteAccountDetails.accountId
    • service.additionalInfo.threatListName
    • service.resourceRole
    • resource.eksClusterDetails.name
    • resource.kubernetesDetails.kubernetesWorkloadDetails.name
    • resource.kubernetesDetails.kubernetesWorkloadDetails.namespace
    • resource.kubernetesDetails.kubernetesUserDetails.username
    • resource.kubernetesDetails.kubernetesWorkloadDetails.containers.image
    • resource.kubernetesDetails.kubernetesWorkloadDetails.containers.imagePrefix
    • service.ebsVolumeScanDetails.scanId
    • service.ebsVolumeScanDetails.scanDetections.threatDetectedByName.threatNames.name
    • service.ebsVolumeScanDetails.scanDetections.threatDetectedByName.threatNames.severity
    • service.ebsVolumeScanDetails.scanDetections.threatDetectedByName.threatNames.filePaths.hash
    • service.malwareScanDetails.threats.name
    • resource.ecsClusterDetails.name
    • resource.ecsClusterDetails.taskDetails.containers.image
    • resource.ecsClusterDetails.taskDetails.definitionArn
    • resource.containerDetails.image
    • resource.rdsDbInstanceDetails.dbInstanceIdentifier
    • resource.rdsDbInstanceDetails.dbClusterIdentifier
    • resource.rdsDbInstanceDetails.engine
    • resource.rdsDbUserDetails.user
    • resource.rdsDbInstanceDetails.tags.key
    • resource.rdsDbInstanceDetails.tags.value
    • service.runtimeDetails.process.executableSha256
    • service.runtimeDetails.process.name
    • service.runtimeDetails.process.name
    • resource.lambdaDetails.functionName
    • resource.lambdaDetails.functionArn
    • resource.lambdaDetails.tags.key
    • resource.lambdaDetails.tags.value

    Tag, TagArgs

    Key string
    The key name of the tag
    Value string
    The value of the tag
    Key string
    The key name of the tag
    Value string
    The value of the tag
    key String
    The key name of the tag
    value String
    The value of the tag
    key string
    The key name of the tag
    value string
    The value of the tag
    key str
    The key name of the tag
    value str
    The value of the tag
    key String
    The key name of the tag
    value String
    The value of the tag

    Package Details

    Repository
    AWS Native pulumi/pulumi-aws-native
    License
    Apache-2.0
    aws-native logo

    We recommend new projects start with resources from the AWS provider.

    AWS Cloud Control v1.26.0 published on Wednesday, Mar 12, 2025 by Pulumi
    pulumi/pulumi-aws-native