AWS GuardDuty Archive Findings

aws_guardduty_archive_findings.sh

#!/bin/sh

PROFILE=hoge
regions=$(aws ec2 describe-regions | jq -r '.Regions[].RegionName')

for region in $(echo ${regions})
do
	echo "region: $region"

	detector_id=$(aws --profile ${PROFILE} \
		guardduty list-detectors \
		--region ${REGION} \
		| jq -r '.DetectorIds[]')

	findings_ids=$(aws --profile ${PROFILE} \
		guardduty list-findings \
		--detector-id ${detector_id} \
		--region ${REGION} \
		| jq -r '.FindingIds[]')

	ids=$(echo -n ${findings_ids} | tr '\n' ',')

	aws --profile ${PROFILE} \
		guardduty archive-findings \
		--detector-id ${detector_id} \
		--finding-ids ${ids} \
		--region ${REGION}
done