SRE-67: Add AWS GuardDuty configuration for security monitoring

[TimDiekmann]

🌟 What is the purpose of this PR?

Add AWS GuardDuty configuration to enhance security monitoring and threat detection capabilities in our AWS infrastructure.

🔗 Related links

• None

🔍 What does this change?

• Implements AWS GuardDuty detector resource in Terraform
• Enables S3 logs monitoring for security threats
• Configures Kubernetes audit logs monitoring
• Sets up malware protection with EBS volume scanning
• Adds appropriate tagging for the GuardDuty detector resource

Pre-Merge Checklist 🚀

🚢 Has this modified a publishable library?

This PR:

• does not modify any publishable blocks or libraries, or modifications do not need publishing

📜 Does this require a change to the docs?

The changes in this PR:

• are internal and do not require a docs change

🕸️ Does this require a change to the Turbo Graph?

The changes in this PR:

• do not affect the execution graph

🛡 What tests cover this?

• Terraform plan validation will verify the resource configuration

❓ How to test this?

1. Run terraform plan to verify the GuardDuty configuration
2. Apply the changes in a test environment
3. Verify GuardDuty detector appears in AWS console with the correct configuration

[TimDiekmann]

• SRE-89: Update Cloudflare provider to version 5.12 #8010
• SRE-88: Enable AWS GuardDuty with PagerDuty notifications #8009
• SRE-67: Add AWS GuardDuty configuration for security monitoring #8006 👈 (View in Graphite)
• SRE-87: Add CloudWatch alarms for RDS I/O monitoring #8005
• SRE-86: Add FreeableMemory CloudWatch alert for RDS #8004
• SRE-80: Add CPUUtilization CloudWatch alert for RDS #8003
• SRE-79: Add FreeStorageSpace CloudWatch alert for RDS #8002
• SRE-82: Replace Slack alerts with PagerDuty integration for Grafana monitoring #8001
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[graphite-app]

Graphite Automations

"Request DevOps reviewers once CI passes" took an action on this PR • (11/04/25)

1 reviewer was added to this PR based on Tim Diekmann's automation.

[graphite-app]

Merge activity

• Nov 4, 7:11 PM UTC: Graphite rebased this pull request, because this pull request is set to merge when ready.