How can I implement a real-time threat detection for security analytics using AWS GuardDuty findings and AWS Lambda in TypeScript

Question

Pulumi · Accepted Answer

Real-time threat detection in AWS infrastructure can be achieved by using AWS GuardDuty to monitor for suspicious activity and AWS Lambda to process and respond to findings in real-time. AWS GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior. When GuardDuty detects a threat, it generates a finding, which can then trigger a Lambda function to handle the threat automatically.

Below you will find a program written in TypeScript using Pulumi to set up this real-time threat detection system.

The program will:

1. Create a new AWS GuardDuty Detector, which is the primary GuardDuty resource that represents the threat detection service.
2. Set up an AWS Lambda function which will be invoked when new GuardDuty findings are published.
3. Define a GuardDuty PublishingDestination resource which handles exporting the findings to a specified destination, in our case, triggering our AWS Lambda function.

Here's the code that sets this up:

```typescript
import * as pulumi from '@pulumi/pulumi';
import * as aws from '@pulumi/aws';
import * as awsNative from '@pulumi/aws-native';

// Create a new GuardDuty Detector
const detector = new aws.guardduty.Detector("myDetector", {
    enable: true,
});

// Define the AWS Lambda function that will handle the GuardDuty findings
const threatResponseFunction = new aws.lambda.Function("threatResponseFunction", {
    code: new pulumi.asset.AssetArchive({
        ".": new pulumi.asset.FileArchive("./lambda"), // Assumes there is a folder './lambda' with your Lambda code
    }),
    runtime: aws.lambda.Runtime.NodeJS14dX, // Choose the supported AWS Lambda runtime
    handler: "index.handler", // Replace with your handler name
    role: lambdaExecutionRole.arn, // Replace with the ARN of the role the Lambda will assume
});

// IAM role that the Lambda function will assume
const lambdaExecutionRole = new aws.iam.Role("lambdaExecutionRole", {
    assumeRolePolicy: {
        Version: "2012-10-17",
        Statement: [{
            Action: "sts:AssumeRole",
            Effect: "Allow",
            Principal: {
                Service: "lambda.amazonaws.com",
            },
        }],
    },
});

// Attach the AWSLambdaBasicExecutionRole policy to the Lambda role for logging
const lambdaLoggingPolicyAttachment = new aws.iam.RolePolicyAttachment("lambdaLoggingPolicyAttachment", {
    role: lambdaExecutionRole,
    policyArn: "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",
});

// Set GuardDuty to publish findings to the Lambda function using a PublishingDestination
const publishingDestination = new aws.guardduty.PublishingDestination("publishingDestination", {
    destinationType: "S3" as "S3",
    detectorId: detector.id,
    destinationProperties: {
        destinationArn: lambdaDestination.arn,
    },
});

export const guardDutyDetectorId = detector.id;
export const lambdaFunctionName = threatResponseFunction.name;
export const lambdaFunctionArn = threatResponseFunction.arn;
```

In this program, you'll need to replace `"./lambda"` with the path to the folder containing your Lambda function code. Ensure your Lambda function has logic to parse the GuardDuty findings and perform the necessary actions or notifications according to your specific use case.

Remember, GuardDuty can potentially generate a large number of findings; make sure your Lambda function is built to handle the expected load and that you have appropriate error handling and logging in place.

When you run this Pulumi program, it will set up the GuardDuty Detector, the Lambda function, and the necessary permissions and triggers.

Make sure you also have the AWS CLI installed and configured with the necessary permissions to create these resources before running the Pulumi program. You can run this program with the Pulumi CLI by using the `pulumi up` command after initializing a new Pulumi project and placing this TypeScript code in the `index.ts` file.