Package com.pulumi.aws.guardduty

Class PublishingDestination

  • public class PublishingDestination
extends com.pulumi.resources.CustomResource
    Provides a resource to manage a GuardDuty PublishingDestination. Requires an existing GuardDuty Detector. ## Example Usage 
     
 package generated_program;
 
 import com.pulumi.Context;
 import com.pulumi.Pulumi;
 import com.pulumi.core.Output;
 import com.pulumi.aws.AwsFunctions;
 import com.pulumi.aws.inputs.GetCallerIdentityArgs;
 import com.pulumi.aws.inputs.GetRegionArgs;
 import com.pulumi.aws.s3.Bucket;
 import com.pulumi.aws.s3.BucketArgs;
 import com.pulumi.aws.iam.IamFunctions;
 import com.pulumi.aws.iam.inputs.GetPolicyDocumentArgs;
 import com.pulumi.aws.iam.inputs.GetPolicyDocumentStatementArgs;
 import com.pulumi.aws.iam.inputs.GetPolicyDocumentStatementPrincipalArgs;
 import com.pulumi.aws.guardduty.Detector;
 import com.pulumi.aws.guardduty.DetectorArgs;
 import com.pulumi.aws.s3.BucketAcl;
 import com.pulumi.aws.s3.BucketAclArgs;
 import com.pulumi.aws.s3.BucketPolicy;
 import com.pulumi.aws.s3.BucketPolicyArgs;
 import com.pulumi.aws.kms.Key;
 import com.pulumi.aws.kms.KeyArgs;
 import com.pulumi.aws.guardduty.PublishingDestination;
 import com.pulumi.aws.guardduty.PublishingDestinationArgs;
 import com.pulumi.resources.CustomResourceOptions;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Map;
 import java.io.File;
 import java.nio.file.Files;
 import java.nio.file.Paths;
 
 public class App {
     public static void main(String[] args) {
         Pulumi.run(App::stack);
     }
 
     public static void stack(Context ctx) {
         final var current = AwsFunctions.getCallerIdentity(GetCallerIdentityArgs.builder()
             .build());
 
         final var currentGetRegion = AwsFunctions.getRegion(GetRegionArgs.builder()
             .build());
 
         var gdBucket = new Bucket("gdBucket", BucketArgs.builder()
             .bucket("example")
             .forceDestroy(true)
             .build());
 
         final var bucketPol = IamFunctions.getPolicyDocument(GetPolicyDocumentArgs.builder()
             .statements(            
                 GetPolicyDocumentStatementArgs.builder()
                     .principals(GetPolicyDocumentStatementPrincipalArgs.builder()
                         .type("Service")
                         .identifiers("guardduty.amazonaws.com")
                         .build())
                     .sid("Allow PutObject")
                     .actions("s3:PutObject")
                     .resources(gdBucket.arn().applyValue(_arn -> String.format("%s/*", _arn)))
                     .build(),
                 GetPolicyDocumentStatementArgs.builder()
                     .principals(GetPolicyDocumentStatementPrincipalArgs.builder()
                         .type("Service")
                         .identifiers("guardduty.amazonaws.com")
                         .build())
                     .sid("Allow GetBucketLocation")
                     .actions("s3:GetBucketLocation")
                     .resources(gdBucket.arn())
                     .build())
             .build());
 
         final var kmsPol = IamFunctions.getPolicyDocument(GetPolicyDocumentArgs.builder()
             .statements(            
                 GetPolicyDocumentStatementArgs.builder()
                     .principals(GetPolicyDocumentStatementPrincipalArgs.builder()
                         .type("Service")
                         .identifiers("guardduty.amazonaws.com")
                         .build())
                     .sid("Allow GuardDuty to encrypt findings")
                     .actions("kms:GenerateDataKey")
                     .resources(String.format("arn:aws:kms:%s:%s:key/*", currentGetRegion.region(),current.accountId()))
                     .build(),
                 GetPolicyDocumentStatementArgs.builder()
                     .principals(GetPolicyDocumentStatementPrincipalArgs.builder()
                         .type("AWS")
                         .identifiers(String.format("arn:aws:iam::%s:root", current.accountId()))
                         .build())
                     .sid("Allow all users to modify/delete key (test only)")
                     .actions("kms:*")
                     .resources(String.format("arn:aws:kms:%s:%s:key/*", currentGetRegion.region(),current.accountId()))
                     .build())
             .build());
 
         var testGd = new Detector("testGd", DetectorArgs.builder()
             .enable(true)
             .build());
 
         var gdBucketAcl = new BucketAcl("gdBucketAcl", BucketAclArgs.builder()
             .bucket(gdBucket.id())
             .acl("private")
             .build());
 
         var gdBucketPolicy = new BucketPolicy("gdBucketPolicy", BucketPolicyArgs.builder()
             .bucket(gdBucket.id())
             .policy(bucketPol.applyValue(_bucketPol -> _bucketPol.json()))
             .build());
 
         var gdKey = new Key("gdKey", KeyArgs.builder()
             .description("Temporary key for AccTest of TF")
             .deletionWindowInDays(7)
             .policy(kmsPol.json())
             .build());
 
         var test = new PublishingDestination("test", PublishingDestinationArgs.builder()
             .detectorId(testGd.id())
             .destinationArn(gdBucket.arn())
             .kmsKeyArn(gdKey.arn())
             .build(), CustomResourceOptions.builder()
                 .dependsOn(gdBucketPolicy)
                 .build());
 
     }
 }
    > **Note:** Please do not use this simple example for Bucket-Policy and KMS Key Policy in a production environment. It is much too open for such a use-case. Refer to the AWS documentation here: https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_exportfindings.html ## Import Using `pulumi import`, import GuardDuty PublishingDestination using the master GuardDuty detector ID and PublishingDestinationID. For example: ```sh $ pulumi import aws:guardduty/publishingDestination:PublishingDestination test a4b86f26fa42e7e7cf0d1c333ea77777:a4b86f27a0e464e4a7e0516d242f1234 ```

    • Nested Class Summary

      • Nested classes/interfaces inherited from class com.pulumi.resources.CustomResource

        com.pulumi.resources.CustomResource.CustomResourceInternal

      • Nested classes/interfaces inherited from class com.pulumi.resources.Resource

        com.pulumi.resources.Resource.LazyField<T extends java.lang.Object>, com.pulumi.resources.Resource.LazyFields, com.pulumi.resources.Resource.ResourceInternal

    • Field Summary

      • Fields inherited from class com.pulumi.resources.Resource

        childResources, remote

    • Method Summary

      All Methods Static Methods Instance Methods Concrete Methods 
      Modifier and Type Method Description
      com.pulumi.core.Output<java.lang.String> arn()  
      com.pulumi.core.Output<java.lang.String> destinationArn()  
      com.pulumi.core.Output<java.lang.String> destinationId()  
      com.pulumi.core.Output<java.util.Optional<java.lang.String>> destinationType()  
      com.pulumi.core.Output<java.lang.String> detectorId()  
      static PublishingDestination get​(java.lang.String name, com.pulumi.core.Output<java.lang.String> id, PublishingDestinationState state, com.pulumi.resources.CustomResourceOptions options)
      Get an existing Host resource's state with the given name, ID, and optional extra properties used to qualify the lookup.
      com.pulumi.core.Output<java.lang.String> kmsKeyArn()  
      com.pulumi.core.Output<java.lang.String> region()  
      com.pulumi.core.Output<java.util.Optional<java.util.Map<java.lang.String,​java.lang.String>>> tags()  
      com.pulumi.core.Output<java.util.Map<java.lang.String,​java.lang.String>> tagsAll()  

      • Methods inherited from class com.pulumi.resources.CustomResource

        getId, id, idFuture

      • Methods inherited from class com.pulumi.resources.Resource

        getChildResources, getResourceName, getResourceType, getUrn, pulumiChildResources, pulumiResourceName, pulumiResourceType, urn

      • Methods inherited from class java.lang.Object

        clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

    • Constructor Detail

      • PublishingDestination

        public PublishingDestination​(java.lang.String name)
        Parameters:
        name - The _unique_ name of the resulting resource.

      • PublishingDestination

        public PublishingDestination​(java.lang.String name,
                             PublishingDestinationArgs args)
        Parameters:
        name - The _unique_ name of the resulting resource.
        args - The arguments to use to populate this resource's properties.

      • PublishingDestination

        public PublishingDestination​(java.lang.String name,
                             PublishingDestinationArgs args,
                             @Nullable
                             com.pulumi.resources.CustomResourceOptions options)
        Parameters:
        name - The _unique_ name of the resulting resource.
        args - The arguments to use to populate this resource's properties.
        options - A bag of options that control this resource's behavior.

    • Method Detail

      • arn

        public com.pulumi.core.Output<java.lang.String> arn()
        Returns:
        Resource ARN.

      • destinationArn

        public com.pulumi.core.Output<java.lang.String> destinationArn()
        Returns:
        Bucket ARN and prefix under which the findings get exported. Bucket-ARN is required, the prefix is optional and will be `AWSLogs/[Account-ID]/GuardDuty/[Region]/` if not provided

      • destinationId

        public com.pulumi.core.Output<java.lang.String> destinationId()
        Returns:
        Destination ID.

      • destinationType

        public com.pulumi.core.Output<java.util.Optional<java.lang.String>> destinationType()
        Returns:
        Currently there is only "S3" available as destination type which is also the default value

      • detectorId

        public com.pulumi.core.Output<java.lang.String> detectorId()
        Returns:
        Detector ID of the GuardDuty.

      • kmsKeyArn

        public com.pulumi.core.Output<java.lang.String> kmsKeyArn()
        Returns:
        ARN of the KMS key used to encrypt GuardDuty findings. GuardDuty enforces this to be encrypted.

      • region

        public com.pulumi.core.Output<java.lang.String> region()
        Returns:
        Region where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration.

      • tags

        public com.pulumi.core.Output<java.util.Optional<java.util.Map<java.lang.String,​java.lang.String>>> tags()
        Returns:
        Key-value map of resource tags. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level. > **Note:** In case of missing permissions (S3 Bucket Policy _or_ KMS Key permissions) the resource will fail to create. If the permissions are changed after resource creation, this can be asked from the AWS API via the "DescribePublishingDestination" call (https://docs.aws.amazon.com/cli/latest/reference/guardduty/describe-publishing-destination.html).

      • tagsAll

        public com.pulumi.core.Output<java.util.Map<java.lang.String,​java.lang.String>> tagsAll()
        Returns:
        Map of tags assigned to the resource, including those inherited from the provider `defaultTags` configuration block.

      • get

        public static PublishingDestination get​(java.lang.String name,
                                        com.pulumi.core.Output<java.lang.String> id,
                                        @Nullable
                                        PublishingDestinationState state,
                                        @Nullable
                                        com.pulumi.resources.CustomResourceOptions options)
        Get an existing Host resource's state with the given name, ID, and optional extra properties used to qualify the lookup.
        Parameters:
        name - The _unique_ name of the resulting resource.
        id - The _unique_ provider ID of the resource to lookup.
        state -
        options - Optional settings to control the behavior of the CustomResource.