The account changes the meaning
Sharing a machine image outside an AWS account can be a release engineer’s job. The same action in a client’s private production account may warrant a security investigation. In a November 10 technical briefing, AWS used that distinction to explain how customers can evaluate its optional GuardDuty detection rules before generating findings. AWS supplies the detection logic. The customer decides where the activity is unusual enough to investigate.
What the trial measures
During a dry run, matching activity contributes to a CloudWatch metric. GuardDuty issues no findings for that rule during the trial, which expires after 14 days. AWS says a rule that sees no matches produces no metric data. An analyst looking at an empty chart consequently needs to know whether the rule was active for the period and which accounts it covered. For rules that depend on activity inside workloads, a further dependency applies: customers must separately enable GuardDuty Runtime Monitoring.
A provider’s decision after two weeks
A security consultancy operating several customer environments has good reason to retain the account context behind each measurement. A high count in an image distribution account can be reconciled against scheduled releases. An identical count in a client account with no distribution function deserves a different response. Simply eliminating the noisiest rules could discard precisely the activity a client hired the firm to find. AWS allows a delegated administrator to apply a rule across member accounts and exclude selected accounts from live alerts. That gives the consultancy a concrete decision to document for its customer: which exceptions it approved, and which matches someone will investigate.
Sources & further reading
Our practical suggestions are editorial guidance. Verify applicability against current source and vendor instructions.
