How do I set up a trusted IP address list for GuardDuty?

Short description

You can configure GuardDuty to use your own custom trusted IP list. Use this list to configure your allowed IP addresses for secure communication with your AWS infrastructure and applications. For more information, see Working with trusted IP lists and threat lists.

Resolution

Create a trusted IP list

Review the accepted format for trusted IP list files. Then, follow the instructions to upload the file to an Amazon Simple Storage Service (Amazon S3) bucket.

Note: The trusted IP list file must be in TXT, STIX, OTX_CSV, ALIEN_VAULT, PROOF_POINT, or FIRE_EYE format. The trusted IP list doesn't support IPv6 addresses. You can have a maximum number of 2000 IP addresses and CIDR for each trusted IP list. You can have only one trusted IP list per Detector resource. For more information, see Quotas for Amazon GuardDuty.

Check IAM identity permissions

Be sure that your AWS Identity and Access Management (IAM) identity has permissions with trusted IP lists and GuardDuty:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "VisualEditor0",
      "Effect": "Allow",
      "Action": [
        "guardduty:*IPSet*",
        "guardduty:List*",
        "guardduty:Get*"
      ],
      "Resource": "*"
    }
  ]
}

Be sure that your IAM identity has permissions for PutRolePolicy and DeleteRolePolicy for the GuardDuty service linked role AWSServiceRoleForAmazonGuardDuty.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "VisualEditor0",
      "Effect": "Allow",
      "Action": [
        "iam:DeleteRolePolicy",
        "iam:PutRolePolicy"
      ],
      "Resource": "arn:aws:iam::123456789123:role/aws-service-role/guardduty.amazonaws.com/AWSServiceRoleForAmazonGuardDuty"
    }
  ]
}

For more information, see Editing IAM policies.

Add and activate a trusted IP list in GuardDuty

1. Open the GuardDuty console.
2. In the navigation pane, choose Lists.
3. Choose Add a trusted IP list.
4. For List name, enter a name that is meaningful to you.
5. For Location, enter the location for your S3 bucket. For example, https://s3.amazonaws.com/bucket-name/file.txt.
6. Choose the Format dropdown menu, and then choose your list's file type.
7. Select the I agree check box, and then choose Add list.
8. In Trusted IP lists, choose Active for your trusted IP list name.

Note: It might take up to 5 minutes for the list to activate.

If you change a trusted IP list in GuardDuty, you must update and then reactivate the list. For instructions, see To update trusted IP lists and threat lists.

Related information

How to use Amazon GuardDuty and AWS Web Application Firewall to automatically block suspicious hosts

Why did GuardDuty send me alert findings for a trusted IP list address?