As an administrator account that already has GuardDuty enabled, you can add members to start using GuardDuty. After adding the members, you can invite them to join GuardDuty, and they can choose to respond to your invitation.
Note
GuardDuty recommends using AWS Organizations instead of GuardDuty invitations, to manage your member accounts. For more information, see Managing accounts with AWS Organizations.
Choose a preferred access method to add GuardDuty member accounts as a GuardDuty administrator account.
Step 1 - Add an account
Open the GuardDuty console at https://console.aws.amazon.com/guardduty/
. -
In the navigation pane, choose Accounts.
-
Choose Add accounts by invitation in the top pane.
-
On the Add member accounts page, under Enter account details, enter the AWS account ID and email address associated with the account that you want to add.
-
To add another row to enter account details one at a time, choose Add another account. You can also choose Upload .csv file with account details to add accounts in bulk.
Important
The first line of your csv file must contain the header, as depicted in the following example –
Account ID,Email. Each subsequent line must contain a single valid AWS account ID and its associated email address. The format of a row is valid if it contains only one AWS account ID and the associated email address separated by a comma.Account ID,Email555555555555,user@example.com -
After you have added all the accounts' details, choose Next. You can view the newly-added accounts in the Accounts table. The Status of these accounts will be Invite not sent. For information about sending an invite to one or more added accounts, see Step 2 - Invite an account.
Step 2 - Invite an account
Open the GuardDuty console at https://console.aws.amazon.com/guardduty/
. -
In the navigation pane, choose Accounts.
-
Select one or more accounts that you want to invite to Amazon GuardDuty.
-
Choose Actions dropdown menu and then choose Invite.
-
In the Invitation to GuardDuty dialog box, enter an (optional) invitation message.
If the invited account does not have access to email, select the checkbox Also send an email notification to the root user on the invitee's AWS account and generate an alert in the invitee's AWS Health Dashboard.
-
Choose Send invitation. If the invitees have access to the specified email address they can view the invite by opening the GuardDuty console at https://console.aws.amazon.com/guardduty/
. -
When an invitee accepts the invite, the value in the Status column changes to Invited. For information about accepting an invite, see Step 3 - Accept an invitation.
Step 3 - Accept an invitation
Open the GuardDuty console at https://console.aws.amazon.com/guardduty/
. Important
You must enable GuardDuty before you can view or accept a membership invitation.
-
Do the following only if you haven't enabled GuardDuty yet; otherwise, you can skip this step and continue with the next step.
If you haven't yet enabled GuardDuty, choose Get Started on the Amazon GuardDuty page.
On the Welcome to GuardDuty page, choose Enable GuardDuty.
-
After you enable GuardDuty for your account, use the following steps to accept the membership invitation:
-
In the navigation pane, choose Settings.
-
Choose Accounts.
-
On the Accounts, ensure to verify the owner of the account from which you accept the invitation. Turn on Accept to accept the membership invite.
-
-
After you accept the invite, your account becomes a GuardDuty member account. The account whose owner sent the invitation becomes the GuardDuty administrator account. The administrator account will know that you have accepted the invitation. The Accounts table in their GuardDuty account will get updated. The value in the Status column corresponding to your member account ID will change to Enabled. The administrator account owner can now view and manage GuardDuty and protection plan configurations on behalf of your account. The administrator account can also view and manage GuardDuty findings generated for your member account.
