Deleting member accounts from GuardDuty organization

Open the GuardDuty console at https://console.aws.amazon.com/guardduty/.

To sign in, use the credentials of the delegated GuardDuty administrator account.

In the navigation pane, choose Accounts.

In the Accounts table, you can remove an account that has Type as Via Organizations and Status as Removed (disassociated).

Select one or more accounts with the same Type and Status.

From the Actions dropdown menu, choose Delete account.

Choose Delete accounts to confirm your selection. The selected account member will no longer appear in your Accounts table.

Repeat the preceding steps in each additional Region where you want to delete this member account.

To retrieve the account ID for the member account that you want to delete, use the ListMembers API. Include the OnlyAssociated parameter in your request. If you set this parameter's value to false, GuardDuty returns a members array that provides details about only those accounts that are currently disassociated GuardDuty members.

Alternatively, you can use AWS Command Line Interface (AWS CLI) to run the following command:

aws guardduty list-members --detector-id 12abc34d567e8fa901bc2d34EXAMPLE --only-associated="false" --region us-east-1

Replace 12abc34d567e8fa901bc2d34EXAMPLE with the delegated GuardDuty administrator account detector ID and us-east-1 with the Region where you want to remove this account.

To delete one or more GuardDuty member accounts, run DeleteMembers to delete the member account from the GuardDuty organization.

Alternatively, you can use AWS CLI to run the following command:

aws guardduty delete-members --detector-id 12abc34d567e8fa901bc2d34EXAMPLE --account-ids 111122223333 --region us-east-1

Replace 12abc34d567e8fa901bc2d34EXAMPLE with the delegated GuardDuty administrator account detector ID and us-east-1 by the Region where you want to remove this account. If you have a list of account IDs that you want to remove, separate them by a space character.