# Multi-Account Setup

## **Amazon GuardDuty for Multiple Accounts**

If your organization operates multiple AWS accounts, it’s essential to **centralize security management** to detect threats consistently across your environment. AWS provides a **multi-account GuardDuty setup** that allows you to manage GuardDuty findings from **multiple accounts** in a centralized fashion, using **delegated administrators** and **member accounts**.

### **Overview of Multi-Account Setup**

* **Delegated Administrator / Security Account:**\
  One designated AWS account that centrally manages GuardDuty for other accounts.
* **Member Accounts:**\
  These are the accounts being monitored, and their findings are forwarded to the **administrator account** for centralized visibility.

### **Steps to Set Up GuardDuty for Multiple Accounts**

#### **Step 1: Enable GuardDuty in the Management Account (Delegated Administrator)**

1. **Log in to the Delegated Administrator (Security Account).**
2. Open the **GuardDuty** console.
3. Click **Get Started** and enable GuardDuty in your **primary region**.
4. Repeat the process to enable GuardDuty in other **AWS regions** if needed.

**Step 2: Add Member Accounts**

You can add individual member accounts **manually** or **programmatically** using AWS CLI or AWS Organizations. Below are both methods:

**Method 1: Add Member Accounts Manually**

1. In the GuardDuty console of the **administrator account**, go to **Settings > Accounts**.
2. Click **Add member accounts**.
3. Provide the **AWS account IDs** and **email addresses** of the member accounts.
4. **Send invitations** to the member accounts.
   * Member accounts need to **accept the invitation** from their GuardDuty console to enable centralized monitoring.

**Method 2: Add Member Accounts Programmatically Using AWS CLI**

If you manage many accounts, use the AWS CLI to streamline the process:

```bash
aws guardduty create-members \
    --detector-id <detector-id> \
    --account-details '[{"AccountId": "111122223333", "Email": "example@example.com"}]'
```

* Replace `<detector-id>` with the GuardDuty **detector ID** for the administrator account.
* Use this command for each account you want to invite.

### **Step 3: Automatically Enable GuardDuty Using AWS Organizations**

AWS Organizations allows **automatic GuardDuty enrollment** for all new and existing accounts within your organization.

1. **Log in to the Delegated Administrator account** and open the **GuardDuty** console.
2. Navigate to **Settings > Accounts**.
3. Choose **Enable Auto-Enable** to **automatically add new member accounts** when they join the organization.

Alternatively, use the **AWS CLI** to enable auto-enrollment:

```bash
aws guardduty update-organization-configuration \
    --detector-id <detector-id> \
    --auto-enable
```

### **Step 4: Accept Invitations from Member Accounts**

If you added member accounts manually, they must **accept the invitation** to complete the process.

1. Log in to the **member account**.
2. Open the **GuardDuty** console and navigate to **Settings > Accounts**.
3. **Accept the invitation** sent by the administrator account.

### **Step 5: Enable GuardDuty in All Regions**

To detect threats from across the globe, enable GuardDuty in **all AWS regions**.

* In the GuardDuty console, navigate to **Settings > General Settings**.
* Select **Manage Regions** and **enable GuardDuty across all regions**.

Alternatively, enable GuardDuty across regions using the CLI:

```bash
aws guardduty update-detector \
    --detector-id <detector-id> \
    --enable --region <region-name>
```

### **Step 6: Centralized Findings in the Administrator Account**

Once the setup is complete:

* All **GuardDuty findings** from member accounts will appear in the **administrator account**.
* Findings can be **viewed centrally** through the **GuardDuty console** or queried using **Amazon Athena** if findings are exported to **S3**.

### **Step 7: Automating Responses to GuardDuty Findings**

1.  **CloudWatch Alarms:**

    * Set CloudWatch alarms on findings with specific severities across all accounts.

    ```json
    {
      "AlarmName": "GuardDutyHighSeverityAlert",
      "MetricName": "GuardDutyFinding",
      "Namespace": "AWS/GuardDuty",
      "Statistic": "Sum",
      "Threshold": 7,
      "ComparisonOperator": "GreaterThanOrEqualToThreshold"
    }
    ```
2. **AWS Lambda for Auto-Remediation:**\
   Use **Lambda functions** to automate actions, such as:
   * Disabling compromised IAM users.
   * Isolating affected EC2 instances.

### **Benefits of Multi-Account GuardDuty Setup**

1. **Centralized Monitoring:**
   * All findings from multiple accounts are visible in one place, simplifying investigation and response.
2. **Automated Onboarding:**
   * New accounts are automatically added to GuardDuty through AWS Organizations.
3. **Reduced Management Overhead:**
   * Less manual effort required to maintain consistent security across accounts and regions.
4. **Cost-Effective:**
   * GuardDuty charges are based on the volume of logs analyzed across all member accounts, with no additional setup fees.

### **Troubleshooting Common Issues**

1. **Member Account Invitation Not Accepted:**\
   Ensure that the **invitation email** is correct and the member account has **GuardDuty enabled**.
2. **Findings Not Visible in Administrator Account:**
   * Verify that **invitations were accepted** by member accounts.
   * Check that **GuardDuty is enabled in all regions**.
3. **Auto-Enable Not Working:**\
   Ensure that the **organization configuration** is correctly set to auto-enable GuardDuty.
