> AI agents: this is one page from PostHog's docs. Full index of Markdown docs for LLMs: https://posthog.com/llms.txt

# Linking AWS GuardDuty as a source

Canonical URL: https://posthog.com/docs/data-pipelines/sources/aws-guardduty

> **Cloud region:** This page uses US Cloud hosts. For an EU Cloud project, use `https://eu.posthog.com` instead of `https://us.posthog.com` or `https://app.posthog.com` (app host for links).

## On this page

- [Prerequisites](#prerequisites)
- [Adding a data source](#adding-a-data-source)
- [Creating IAM credentials](#creating-iam-credentials)
- [Sync modes](#sync-modes)
- [Configuration](#configuration)
- [Supported tables](#supported-tables)
- [Troubleshooting](#troubleshooting)

**Beta release**

This source is currently in **beta**. It works end to end, but you may still hit rough edges. [Let us know](https://us.posthog.com/#panel=support%3Asupport%3Adata_warehouse%3A%3Atrue) if you do.

![](https://res.cloudinary.com/dmukukwp6/image/upload/texture_tan_9608fcca70)

![](https://res.cloudinary.com/dmukukwp6/image/upload/texture_tan_dark_a92b0e022d)

Let AI connect your sources for you

Skip the manual setup — run this in your project and the wizard auto-detects your databases and APIs and connects them to PostHog.

`npx @posthog/wizard warehouse`

![PostHog Wizard hedgehog](https://res.cloudinary.com/dmukukwp6/image/upload/wizard_3f8bb7a240.png)

![](https://res.cloudinary.com/dmukukwp6/image/upload/wizard_3f8bb7a240.png)Let AI connect your sources for you

The AWS GuardDuty connector syncs threat findings, detector configuration, member accounts, Runtime Monitoring coverage, malware scans, and usage statistics into the PostHog data warehouse, so you can analyze your AWS security posture alongside your product data.

## Prerequisites

You need an AWS account with GuardDuty enabled in the region you want to sync. You also need an IAM user or role with the following permissions:

-   `guardduty:ListDetectors`
-   `guardduty:GetDetector`
-   `guardduty:ListFindings`
-   `guardduty:GetFindings`
-   `guardduty:ListMembers`
-   `guardduty:ListCoverage`
-   `guardduty:DescribeMalwareScans`
-   `guardduty:GetUsageStatistics`

The `members` table requires a GuardDuty administrator account. If your account is not an administrator, the table syncs no rows.

## Adding a data source

1.  In PostHog, go to the [Sources tab](https://app.posthog.com/data-management/sources) of the data pipeline section.
2.  Click **\+ New source** and click **Link** next to this source.
3.  Enter your credentials (see [Configuration](#configuration) below) and click **Next**.
4.  Select the tables you want to sync, choose a sync method and frequency, then click **Import**.

Once the syncs are complete, you can start querying this data in PostHog.

When linking AWS GuardDuty, you'll need:

-   **AWS access key ID** – the access key ID for your IAM user or role (starts with `AKIA...`).
-   **AWS secret access key** – the corresponding secret access key.
-   **AWS session token** (optional) – only required if you're using temporary STS credentials. Temporary credentials expire, so you'll need to reconnect when they do.
-   **AWS region** – the region where GuardDuty is enabled (for example, `us-east-1`).

## Creating IAM credentials

1.  In the AWS Console, go to **IAM** > **Users** and create a new user (or use an existing one).
2.  Attach a policy with the following permissions:

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "guardduty:ListDetectors",
        "guardduty:GetDetector",
        "guardduty:ListFindings",
        "guardduty:GetFindings",
        "guardduty:ListMembers",
        "guardduty:ListCoverage",
        "guardduty:DescribeMalwareScans",
        "guardduty:GetUsageStatistics"
      ],
      "Resource": "*"
    }
  ]
}
```

3.  Create an access key for your IAM user under **Security credentials** > **Access keys**.
4.  Copy the **Access key ID** and **Secret access key** – you'll need both when linking the source in PostHog.

## Sync modes

Each table can be synced in one of several modes, depending on what the source supports:

-   **Webhook** (when available) – the source pushes changes to PostHog in real time. Fastest freshness, lowest ongoing cost, and the only mode that reliably captures updates and deletes.
-   **Incremental** – only new or updated rows are synced on each run, using a cursor field (such as an `updated_at` timestamp). Cheaper than a full refresh, but deletes aren't captured.
-   **Append only** – new rows are appended using a cursor field; existing rows are never updated. Ideal for immutable, append-only tables like event logs.
-   **Full refresh** – the whole table is reloaded on every sync. Use it when a table has no reliable cursor or when you need deletions reflected.

See [sync methods](https://posthog.com/docs/data-pipelines/sources.md#sync-methods) for a full explanation of how each mode works and how to choose between them.

The `findings` table supports incremental sync using `updated_at` as the cursor. All other tables – `detectors`, `members`, `coverage`, `malware_scans`, and `usage_statistics` – use full refresh, replacing the entire table contents on each sync.

## Configuration

| Option | Description |
| --- | --- |
| `AWS access key ID` **Type:** text **Required:** True |  |
| `AWS secret access key` **Type:** password **Required:** True |  |
| `AWS session token` **Type:** password **Required:** False | Temporary credentials expire. Reconnect with current credentials when the session token expires. |
| `AWS region` **Type:** text **Required:** True |  |

## Supported tables

| Table | Description | Sync method | Incremental field | Primary key |
| --- | --- | --- | --- | --- |
| `findings` | Threat findings, including severity, affected resources, and detection details. | Incremental, Full refresh | updated\_at | — |
| `detectors` | Detector status, enabled features, and configuration in the selected region. | Full refresh | — | — |
| `members` | Member accounts and their relationship with the GuardDuty administrator account. | Full refresh | — | — |
| `coverage` | Runtime Monitoring coverage status for EKS clusters, ECS clusters, and EC2 instances. | Full refresh | — | — |
| `malware_scans` | Malware Protection for EC2 scans, including status, result, trigger, and scanned data volume. | Full refresh | — | — |
| `usage_statistics` | GuardDuty usage cost over the last 30 days, summed by account, feature, and resource. | Full refresh | — | — |

## Troubleshooting

-   If you see "AWS denied access", check that all eight `guardduty:*` permissions are attached to the IAM user or role.
-   If you see "AWS rejected the credentials", check that the access key ID and secret access key are correct and that the key is still active in IAM.
-   If you see a signature error, re-enter the secret access key. If you're using temporary credentials, the session token may have expired.
-   If you see "Enable GuardDuty in the selected AWS region", enable GuardDuty in the region you specified, then reconnect.
-   If the `members` table syncs no rows, your account may not be a GuardDuty administrator. Only administrator accounts can list member accounts.

If your sync is failing or data looks wrong, see the [Data warehouse troubleshooting guide](https://posthog.com/docs/data-warehouse/troubleshooting.md). If that doesn't help, [contact support](https://us.posthog.com/#panel=support%3Asupport%3Adata_warehouse%3A%3Atrue) – we're happy to help.