Skip to content

Instantly share code, notes, and snippets.

@jamesoff

jamesoff/disable-guardduty-k8s-everywhere.sh

Last active January 29, 2022 12:21
Show Gist options
  • Save jamesoff/7226aa2b87c302084c211823c136eb7a to your computer and use it in GitHub Desktop.
Save jamesoff/7226aa2b87c302084c211823c136eb7a to your computer and use it in GitHub Desktop.
Download ZIP
Disable Amazon GuardDuty's k8s feature everywhere
Raw
disable-guardduty-k8s-everywhere.sh
#!/usr/bin/env zsh
# Disable Amazon GuardDuty's k8s log parsing thing everywhere
# Assumes at most one GuardDuty detector in each region
# Docs: https://docs.aws.amazon.com/guardduty/latest/ug/kubernetes-protection.html
for r in $(aws ec2 describe-regions --query 'Regions[].RegionName' --output text); do
detector=$( aws guardduty list-detectors --query DetectorIds --output text --region "$r" )
if [[ -z $detector ]]; then
echo "GuardDury not enabled in $r"
else
echo "Attempting to disable in $r ($detector)"
aws guardduty update-detector \
--detector-id "$detector" \
--data-sources '{"Kubernetes":{"AuditLogs":{"Enable":false}}}' \
--region "$r"
fi
done
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment