Amazon GuardDuty Specification

This document contains a draft proposal for a Code Example for Amazon GuardDuty Basics Scenario, generated by the Code Examples SpecGen AI tool. The specifications describe a potential code example scenario based on research, usage data, service information, and AI-assistance. The following should be reviewed for accuracy and correctness before proceeding on to a final specification.

Relevant documentation

• Getting started with GuardDuty
• What is Amazon GuardDuty?
• Amazon GuardDuty API Reference
• GuardDuty Pricing

API Actions Used

• CreateDetector
• GetDetector
• ListDetectors
• CreateSampleFindings
• ListFindings
• GetFindings
• DeleteDetector

Proposed example structure

The details below describe how this example would run for the customer. It includes a Hello service example (included for all services), and the scenario details. The scenario code would also be presented as Action snippets, with a code snippet for each SDK action.

Hello

The Hello example is a separate runnable example. - Set up the GuardDuty service client - Check if GuardDuty is available in the current region - List any existing detectors

Scenario

Setup

• Create a GuardDuty detector to enable threat detection
• Verify the detector is successfully created and active
• Display detector configuration and status

Sample Findings Generation

• Generate sample findings to demonstrate GuardDuty capabilities
• List the generated sample findings
• Display finding details including severity and type

Findings Management

• Retrieve detailed information about specific findings
• Filter findings by severity level
• Display finding metadata and threat information

Cleanup

• Archive or acknowledge sample findings
• Optionally disable the detector (with user confirmation)
• Clean up resources created during the example

Errors

SDK Code examples include basic exception handling for each action used. The table below describes an appropriate exception which will be handled in the code for each service action.

Action	Error	Handling
CreateDetector	BadRequestException	Validate input parameters and notify user of invalid configuration.
CreateDetector	InternalServerErrorException	Retry operation with exponential backoff.
GetDetector	BadRequestException	Validate detector ID format and existence.
GetDetector	InternalServerErrorException	Retry operation and handle service unavailability.
ListDetectors	BadRequestException	Validate pagination parameters and retry.
ListDetectors	InternalServerErrorException	Handle service errors gracefully.
CreateSampleFindings	BadRequestException	Validate detector ID and finding types.
CreateSampleFindings	InternalServerErrorException	Retry sample finding generation.
ListFindings	BadRequestException	Validate finding criteria and pagination.
GetFindings	BadRequestException	Validate finding IDs format.
DeleteDetector	BadRequestException	Confirm detector exists before deletion.
DeleteDetector	InternalServerErrorException	Handle deletion failures gracefully.

Metadata

action / scenario	metadata file	metadata key
CreateDetector	guardduty_metadata.yaml	guardduty_CreateDetector
GetDetector	guardduty_metadata.yaml	guardduty_GetDetector
ListDetectors	guardduty_metadata.yaml	guardduty_ListDetectors
CreateSampleFindings	guardduty_metadata.yaml	guardduty_CreateSampleFindings
ListFindings	guardduty_metadata.yaml	guardduty_ListFindings
GetFindings	guardduty_metadata.yaml	guardduty_GetFindings
DeleteDetector	guardduty_metadata.yaml	guardduty_DeleteDetector
Amazon GuardDuty Basics Scenario	guardduty_metadata.yaml	guardduty_Scenario