GuardDuty / Client / create_publishing_destination

create_publishing_destination

GuardDuty.Client.create_publishing_destination(**kwargs)

Creates a publishing destination where you can export your GuardDuty findings. Before you start exporting the findings, the destination resource must exist.

See also: AWS API Documentation

Request Syntax

response = client.create_publishing_destination(
    DetectorId='string',
    DestinationType='S3',
    DestinationProperties={
        'DestinationArn': 'string',
        'KmsKeyArn': 'string',
        'ExpectedBucketOwner': 'string'
    },
    ClientToken='string',
    Tags={
        'string': 'string'
    }
)
Parameters:

  • DetectorId (string) –

    [REQUIRED]

    The ID of the GuardDuty detector associated with the publishing destination.

    To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API.

  • DestinationType (string) –

    [REQUIRED]

    The type of resource for the publishing destination. Currently only Amazon S3 buckets are supported.

  • DestinationProperties (dict) –

    [REQUIRED]

    The properties of the publishing destination, including the ARNs for the destination and the KMS key used for encryption.

    • DestinationArn (string) –

      The ARN of the resource to publish to.

      To specify an S3 bucket folder use the following format: arn:aws:s3:::DOC-EXAMPLE-BUCKET/myFolder/

    • KmsKeyArn (string) –

      The ARN of the KMS key to use for encryption.

    • ExpectedBucketOwner (string) –

      The 12-digit Amazon Web Services account ID of the account that owns the Amazon S3 bucket specified in the DestinationArn parameter.

      When you provide this value, GuardDuty verifies that the specified account owns the bucket before it exports findings. If the account ID doesn’t match the actual owner of the bucket, GuardDuty doesn’t export findings to that bucket. This helps prevent GuardDuty from exporting your findings to a bucket that a different Amazon Web Services account owns (for example, if the original bucket was deleted and its name was later claimed by another account). If you don’t specify this value, GuardDuty doesn’t perform this verification. GuardDuty strongly recommends that you provide the expected bucket owner when possible.

      When you update a publishing destination, omitting this field leaves the currently stored value unchanged. This field appears in the response only if it was provided when the publishing destination was created or updated.

      For more information, see Verifying the Amazon S3 bucket owner in the Amazon GuardDuty User Guide.

  • ClientToken (string) –

    The idempotency token for the request.

    This field is autopopulated if not provided.

  • Tags (dict) –

    The tags to be added to a new publishing destination resource.

    • (string) –

      • (string) –

Return type:

dict

Returns:

Response Syntax

{
    'DestinationId': 'string'
}

Response Structure

  • (dict) –

    • DestinationId (string) –

      The ID of the publishing destination that is created.

Exceptions