Amazon GuardDuty Tester

Amazon GuardDuty Tester is a collection of scripts and guidance designed to generate proof-of-concept Amazon GuardDuty findings for real AWS resources. The repository provides multiple independent tests that can be executed individually or collectively to produce various types of security findings. The tool helps users understand how to view and respond to GuardDuty findings by creating controlled test scenarios in their AWS environment. It includes tests for EC2 instances with malware protection capabilities, EKS clusters utilizing Kubernetes Audit Logs and EKS Runtime protection, and additional EC2-related security scenarios. The scripts are intended for deployment in non-production AWS accounts to ensure clear identification of test-generated findings and to contain the broad permissions required for testing. This approach helps minimize the impact of elevated permissions while providing practical insights into GuardDuty's detection capabilities. The repository does not cover every possible GuardDuty finding type but focuses on providing representative examples that demonstrate the service's functionality and help users develop appropriate response procedures for their security operations.