AWS GuardDuty Connector

Amazon GuardDuty is a threat detection service that continuously monitors your AWS accounts and workloads for malicious activity and delivers detailed security findings for visibility and remediation. Bloo integrates with AWS GuardDuty to collect, normalize, and monitor GuardDuty findings in real time.

Before You Begin — Prerequisites

You'll need the following before configuring the connector in Bloo.

Requirement	Where to Get It	Notes
AWS Account	Sign in at console.aws.amazon.com	Must have IAM admin access to create users and attach policies
Access Key ID	Generated from IAM → Users → Security credentials (Step 2 below)	20-character alphanumeric string
Secret Access Key	Generated alongside Access Key ID	Shown only once — copy and store securely
AWS Region	The region where GuardDuty is enabled	Example: us-east-1

Step 1 — Create an IAM Policy

Use the following JSON to define the required permissions for accessing the ListFindings and GetFindings methods.

1. Log in to the AWS Management Console and navigate to IAM.

1. Go to Policies → Create Policy.

2. Select the JSON tab and paste the JSON policy below.

3. Click Next, enter a name for the policy, and click Create Policy.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "guardduty:ListFindings",
                "guardduty:GetFindings"
            ],
            "Resource": "*"
        }
    ]
}Copy

Step 2 — Create an IAM User and Generate Access Keys

1. In the IAM console, go to Users → Create User.

2. Enter a user name and click Next.

3. On the Set permissions page, select Attach policies directly and attach the policy created in Step 1.

4. Click Next and then Create User.

5. Open the newly created user. Go to the Security credentials tab and click Create access key.

6. Select Other as the use case and click Next → Create access key.

7. Copy the Access Key ID and Secret Access Key. Store both securely, these are the credentials you will enter into Bloo.

⚠ Important: The Secret Access Key is shown only once. After you close this page it cannot be retrieved. If you lose it you must delete the access key and create a new one.

Step 3 — Enable AWS GuardDuty

1. In the AWS Management Console, search for and open GuardDuty.

2. Click Get Started and then Enable GuardDuty. This automatically creates a detector for your selected region.

ℹ GuardDuty is a Regional service. You must enable it separately in each AWS Region you want to monitor.

Step 4 — Configure the Connector in Bloo

All connector configuration is done from the Datasource page in Bloo.

1. In Bloo, navigate to the Datasource page and click Add Datasource.

2. Search for and select AWS GuardDuty.

3. Fill in the configuration fields as described below.

Field	Description	Example
Connector Name	A unique display name for this connector instance in Bloo.	GuardDuty-Prod
Access Key	Enter the AWS Access Key ID generated in Step 2.	Paste from Step 2
Secret Key	Enter the AWS Secret Access Key generated in Step 2.	Paste from Step 2
Region	Enter the AWS Region where GuardDuty is enabled.	us-east-1

1. Click Save. Bloo validates the configuration automatically.

✓ Go to Collection Status in Bloo and verify the AWS GuardDuty connector shows status Active.

Related: How to Configure Connectors Connector Validation