Security patterns update

[aliaksei-ivanou]

Issue #, if available:

Description of changes:

1. Updating GuardDuty features configuration in the guardduty pattern.
2. Checking if GuardDuty is already enabled in the target account and region. If yes, making sure that EKS-related features are enabled.
3. Removing the dead link in docs/patterns/kubeflow.md.

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

[shapirov103]

LGTM

[shapirov103]

/do-e2e-test guardduty deploy

[shapirov103]

@aliaksei-ivanou please check the e2e failure:

Failed resources:
guardduty-setup | 1:44:30 PM | CREATE_FAILED        | AWS::GuardDuty::Detector | guardduty-setupGuardDutyDetector (guarddutysetupGuardDutyDetector) Resource handler 
returned message: "Invalid request provided: AWS::GuardDuty::Detector" (RequestToken: bb5d9f83-4589-22e4-e909-a64ee12dd7b9, HandlerErrorCode: InvalidRequest)

(RequestToken: bb5d9f83-4589-22e4-e909-a64ee12dd7b9, HandlerErrorCode: InvalidRequest)

 ❌  guardduty-setup failed: Error: The stack named guardduty-setup failed creation, it may need to be manually deleted from the AWS console: ROLLBACK_COMPLETE: Resource handler returned message: "Invalid request provided: AWS::GuardDuty::Detector" (RequestToken: bb5d9f83-4589-22e4-e909-a64ee12dd7b9, HandlerErrorCode: InvalidRequest)
    at FullCloudFormationDeployment.monitorDeployment (/codebuild/output/src2885543061/src/github.com/aws-samples/cdk-eks-blueprints-patterns/node_modules/aws-cdk/lib/index.js:430:10615)
    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
    at async Object.deployStack2 [as deployStack] (/codebuild/output/src2885543061/src/github.com/aws-samples/cdk-eks-blueprints-patterns/node_modules/aws-cdk/lib/index.js:433:198753)
    at async /codebuild/output/src2885543061/src/github.com/aws-samples/cdk-eks-blueprints-patterns/node_modules/aws-cdk/lib/index.js:433:180693

[shapirov103]

/do-e2e-test guardduty deploy

[aliaksei-ivanou]

@aliaksei-ivanou please check the e2e failure:

Failed resources:
guardduty-setup | 1:44:30 PM | CREATE_FAILED        | AWS::GuardDuty::Detector | guardduty-setupGuardDutyDetector (guarddutysetupGuardDutyDetector) Resource handler 
returned message: "Invalid request provided: AWS::GuardDuty::Detector" (RequestToken: bb5d9f83-4589-22e4-e909-a64ee12dd7b9, HandlerErrorCode: InvalidRequest)

(RequestToken: bb5d9f83-4589-22e4-e909-a64ee12dd7b9, HandlerErrorCode: InvalidRequest)

 ❌  guardduty-setup failed: Error: The stack named guardduty-setup failed creation, it may need to be manually deleted from the AWS console: ROLLBACK_COMPLETE: Resource handler returned message: "Invalid request provided: AWS::GuardDuty::Detector" (RequestToken: bb5d9f83-4589-22e4-e909-a64ee12dd7b9, HandlerErrorCode: InvalidRequest)
    at FullCloudFormationDeployment.monitorDeployment (/codebuild/output/src2885543061/src/github.com/aws-samples/cdk-eks-blueprints-patterns/node_modules/aws-cdk/lib/index.js:430:10615)
    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
    at async Object.deployStack2 [as deployStack] (/codebuild/output/src2885543061/src/github.com/aws-samples/cdk-eks-blueprints-patterns/node_modules/aws-cdk/lib/index.js:433:198753)
    at async /codebuild/output/src2885543061/src/github.com/aws-samples/cdk-eks-blueprints-patterns/node_modules/aws-cdk/lib/index.js:433:180693

Done

[aliaksei-ivanou]

/do-e2e-test guardduty deploy

[shapirov103]

/do-e2e-test guardduty deploy

[shapirov103]

GuardDuty blueprint stack did not deploy due to missing secrets. Rerunning with the secret setup.

[shapirov103]

/do-e2e-test guardduty deploy

[shapirov103]

Getting this issue during synth time:

AccessDeniedException: User: arn:aws:sts::867286930927:assumed-role/codebuild-ci-service-role/AWSCodeBuild-17452f2d-30db-43f1-b797-2a1e488a7ff2 is not authorized to perform: guardduty:ListDetectors on resource: arn:aws:guardduty:us-east-2:867286930927:detector/*

Is listdetectors the only permission neeed @aliaksei-ivanou ?

[aliaksei-ivanou]

Getting this issue during synth time:

AccessDeniedException: User: arn:aws:sts::867286930927:assumed-role/codebuild-ci-service-role/AWSCodeBuild-17452f2d-30db-43f1-b797-2a1e488a7ff2 is not authorized to perform: guardduty:ListDetectors on resource: arn:aws:guardduty:us-east-2:867286930927:detector/*

Is listdetectors the only permission neeed @aliaksei-ivanou ?

ListDetectors and UpdateDetector

[shapirov103]

@aliaksei-ivanou UpdateDetector is needed at deploy, not synth time, correct?

[aliaksei-ivanou]

@aliaksei-ivanou UpdateDetector is needed at deploy, not synth time, correct?

I believe so.

[shapirov103]

/do-e2e-test guardduty deploy

[shapirov103]

/do-e2e-test guardduty destroy

[shapirov103]

LGTM