How to Forward Amazon GuardDuty Findings to S3 and EventBridge

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Create an Amazon EventBridge rule that matches GuardDuty findings and triggers an SNS topic.

  Why this is correct

  Amazon GuardDuty publishes all generated findings to Amazon EventBridge (formerly CloudWatch Events) as events with a detail type of 'GuardDuty Finding'. By creating an EventBridge rule that matches the finding severity (for example, using the 'severity' field in the event detail) and setting the target to an SNS topic, you can send near-real-time alerts to security teams. This is the native, recommended integration path, and it also allows you to route findings to AWS Lambda, Step Functions, or other targets for automated remediation.

• ✗

  Configure CloudWatch Logs to monitor GuardDuty logs and create a metric filter for high-severity findings.

  Why it's wrong here

  GuardDuty does not export or send findings to CloudWatch Logs; it delivers findings directly to EventBridge and (if configured) to S3 via AWS Organizations or a delegated administrator. CloudWatch Logs only captures log data from supported services like CloudTrail, VPC Flow Logs, or DNS logs, but GuardDuty findings themselves never appear as CloudWatch Logs log streams. Therefore, a metric filter on a nonexistent GuardDuty log group would be ineffective. If you want to use CloudWatch Logs for alerting, you would first need to create a custom pipeline—e.g., using a Lambda function triggered by EventBridge to write findings into CloudWatch Logs—but that is an extra step, not a direct GuardDuty capability.

• ✗

  Set up an S3 event notification on the GuardDuty findings bucket.

  Why it's wrong here

  GuardDuty findings are not stored in an S3 bucket by default; you must explicitly enable the 'Export findings to S3' feature, typically through AWS Organizations to aggregate findings to a central bucket, and even then the bucket is managed by GuardDuty (or by the delegated administrator) with a specific prefix. S3 event notifications require the bucket to exist and the object writes to be triggered by an event such as PutObject—but GuardDuty does not emit S3 events for new findings unless you configure that custom export. Even with the export enabled, the S3 event notification would only fire when the finding is written to the bucket, which adds latency and is not the primary real-time alerting path. The native approach is EventBridge, not S3 notifications.

• ✗

  Configure GuardDuty to send email notifications for all findings.

  Why it's wrong here

  GuardDuty has no built-in email notification feature; it does not send emails directly, nor does it have a 'configure email' setting in the console. To get email alerts, you must route findings through an SNS topic, and that SNS topic must subscribe an email endpoint. Simply enabling GuardDuty does not generate email alerts by default, and you cannot configure GuardDuty to send email for 'all findings' without building an EventBridge rule that targets SNS. Without such a rule, GuardDuty will only publish findings to EventBridge, and unless you subscribe to that event, no notification will be sent.

Go deeper

Related to this question