aws-sdk-guardduty 1.135.0 → 1.136.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cb7c57a7aea7ba00faa2b8e073ff7e38937522cc2722ab038e6a8cd62848d050
-  data.tar.gz: a8a95b3e51756e730ac23d39b6257385291d9f676b981bd6e5c6dd80c81f104a
+  metadata.gz: f07204f579d7e8f8b04ff6aad2c948fc7b40c3f1f20f604d6b90902af692c426
+  data.tar.gz: 49f5e479e99c0f5857b60d1264400875b14790f4b56bdcdfe7f85318f9860e8e
 SHA512:
-  metadata.gz: 35b1fe945323fc3240608b6b05b2e9ff5ddd1af45d1d49430a2a528bcece792e7dab6376b7b05508526866b5ad493fc9e617c6fb3161d1994bf0f530ddddea33
-  data.tar.gz: 3a0dcf63a6929d13815d9d95b3430b5191e06246c3337e993cc7150f8707ee9e0e9bfce5f6b9b551645637f50710b7a65a8b44e98f9b993c6ca980cb6bc62ef3
+  metadata.gz: 7e026d2fb68ca6ed93f335f1155d750cf78a27cdc0f53f5f592a40d25d0f9f968b509e25abc222eb1a234dd167a8c6d0c6ad4a07fd9fa3a2fe160cc204543ac9
+  data.tar.gz: 3fb8acab14c1cf8bba779dae2ca83f79aacd8f1446d9449d3b9907b297d683d023762aec5bb2737dd5d72671356aaac185629174c229313e143dd00a9c093d56

data/CHANGELOG.md

@@ -1,6 +1,11 @@
 Unreleased Changes
 ------------------
 
+1.136.0 (2025-12-02)
+------------------
+
+* Feature - Adding support for extended threat detection for Amazon EC2 and Amazon ECS. Adding support for wild card suppression rules.
+
 1.135.0 (2025-11-21)
 ------------------
 

data/VERSION

@@ -1 +1 @@
-1.135.0
+1.136.0

data/lib/aws-sdk-guardduty/client.rb

@@ -1004,6 +1004,8 @@ module Aws::GuardDuty
     #           greater_than_or_equal: 1,
     #           less_than: 1,
     #           less_than_or_equal: 1,
+    #           matches: ["Match"],
+    #           not_matches: ["NotMatch"],
     #         },
     #       },
     #     },
@@ -2668,6 +2670,10 @@ module Aws::GuardDuty
     #   resp.finding_criteria.criterion["String"].greater_than_or_equal #=> Integer
     #   resp.finding_criteria.criterion["String"].less_than #=> Integer
     #   resp.finding_criteria.criterion["String"].less_than_or_equal #=> Integer
+    #   resp.finding_criteria.criterion["String"].matches #=> Array
+    #   resp.finding_criteria.criterion["String"].matches[0] #=> String
+    #   resp.finding_criteria.criterion["String"].not_matches #=> Array
+    #   resp.finding_criteria.criterion["String"].not_matches[0] #=> String
     #   resp.tags #=> Hash
     #   resp.tags["TagKey"] #=> String
     #
@@ -3217,7 +3223,7 @@ module Aws::GuardDuty
     #   resp.findings[0].service.detection.sequence.resources[0].uid #=> String
     #   resp.findings[0].service.detection.sequence.resources[0].name #=> String
     #   resp.findings[0].service.detection.sequence.resources[0].account_id #=> String
-    #   resp.findings[0].service.detection.sequence.resources[0].resource_type #=> String, one of "EC2_INSTANCE", "EC2_NETWORK_INTERFACE", "S3_BUCKET", "S3_OBJECT", "ACCESS_KEY", "EKS_CLUSTER", "KUBERNETES_WORKLOAD", "CONTAINER"
+    #   resp.findings[0].service.detection.sequence.resources[0].resource_type #=> String, one of "EC2_INSTANCE", "EC2_NETWORK_INTERFACE", "S3_BUCKET", "S3_OBJECT", "ACCESS_KEY", "EKS_CLUSTER", "KUBERNETES_WORKLOAD", "CONTAINER", "ECS_CLUSTER", "ECS_TASK", "AUTOSCALING_AUTO_SCALING_GROUP", "IAM_INSTANCE_PROFILE", "CLOUDFORMATION_STACK", "EC2_LAUNCH_TEMPLATE", "EC2_VPC", "EC2_IMAGE"
     #   resp.findings[0].service.detection.sequence.resources[0].region #=> String
     #   resp.findings[0].service.detection.sequence.resources[0].service #=> String
     #   resp.findings[0].service.detection.sequence.resources[0].cloud_partition #=> String
@@ -3283,6 +3289,27 @@ module Aws::GuardDuty
     #   resp.findings[0].service.detection.sequence.resources[0].data.kubernetes_workload.kubernetes_resources_types #=> String, one of "PODS", "JOBS", "CRONJOBS", "DEPLOYMENTS", "DAEMONSETS", "STATEFULSETS", "REPLICASETS", "REPLICATIONCONTROLLERS"
     #   resp.findings[0].service.detection.sequence.resources[0].data.container.image #=> String
     #   resp.findings[0].service.detection.sequence.resources[0].data.container.image_uid #=> String
+    #   resp.findings[0].service.detection.sequence.resources[0].data.ecs_cluster.status #=> String, one of "ACTIVE", "PROVISIONING", "DEPROVISIONING", "FAILED", "INACTIVE"
+    #   resp.findings[0].service.detection.sequence.resources[0].data.ecs_cluster.ec2_instance_uids #=> Array
+    #   resp.findings[0].service.detection.sequence.resources[0].data.ecs_cluster.ec2_instance_uids[0] #=> String
+    #   resp.findings[0].service.detection.sequence.resources[0].data.ecs_task.created_at #=> Time
+    #   resp.findings[0].service.detection.sequence.resources[0].data.ecs_task.task_definition_arn #=> String
+    #   resp.findings[0].service.detection.sequence.resources[0].data.ecs_task.launch_type #=> String, one of "FARGATE", "EC2"
+    #   resp.findings[0].service.detection.sequence.resources[0].data.ecs_task.container_uids #=> Array
+    #   resp.findings[0].service.detection.sequence.resources[0].data.ecs_task.container_uids[0] #=> String
+    #   resp.findings[0].service.detection.sequence.resources[0].data.iam_instance_profile.ec2_instance_uids #=> Array
+    #   resp.findings[0].service.detection.sequence.resources[0].data.iam_instance_profile.ec2_instance_uids[0] #=> String
+    #   resp.findings[0].service.detection.sequence.resources[0].data.autoscaling_auto_scaling_group.ec2_instance_uids #=> Array
+    #   resp.findings[0].service.detection.sequence.resources[0].data.autoscaling_auto_scaling_group.ec2_instance_uids[0] #=> String
+    #   resp.findings[0].service.detection.sequence.resources[0].data.ec2_launch_template.ec2_instance_uids #=> Array
+    #   resp.findings[0].service.detection.sequence.resources[0].data.ec2_launch_template.ec2_instance_uids[0] #=> String
+    #   resp.findings[0].service.detection.sequence.resources[0].data.ec2_launch_template.version #=> String
+    #   resp.findings[0].service.detection.sequence.resources[0].data.ec2_vpc.ec2_instance_uids #=> Array
+    #   resp.findings[0].service.detection.sequence.resources[0].data.ec2_vpc.ec2_instance_uids[0] #=> String
+    #   resp.findings[0].service.detection.sequence.resources[0].data.ec2_image.ec2_instance_uids #=> Array
+    #   resp.findings[0].service.detection.sequence.resources[0].data.ec2_image.ec2_instance_uids[0] #=> String
+    #   resp.findings[0].service.detection.sequence.resources[0].data.cloudformation_stack.ec2_instance_uids #=> Array
+    #   resp.findings[0].service.detection.sequence.resources[0].data.cloudformation_stack.ec2_instance_uids[0] #=> String
     #   resp.findings[0].service.detection.sequence.endpoints #=> Array
     #   resp.findings[0].service.detection.sequence.endpoints[0].id #=> String
     #   resp.findings[0].service.detection.sequence.endpoints[0].ip #=> String
@@ -3430,6 +3457,8 @@ module Aws::GuardDuty
     #           greater_than_or_equal: 1,
     #           less_than: 1,
     #           less_than_or_equal: 1,
+    #           matches: ["Match"],
+    #           not_matches: ["NotMatch"],
     #         },
     #       },
     #     },
@@ -4743,6 +4772,8 @@ module Aws::GuardDuty
     #           greater_than_or_equal: 1,
     #           less_than: 1,
     #           less_than_or_equal: 1,
+    #           matches: ["Match"],
+    #           not_matches: ["NotMatch"],
     #         },
     #       },
     #     },
@@ -5807,6 +5838,8 @@ module Aws::GuardDuty
     #           greater_than_or_equal: 1,
     #           less_than: 1,
     #           less_than_or_equal: 1,
+    #           matches: ["Match"],
+    #           not_matches: ["NotMatch"],
     #         },
     #       },
     #     },
@@ -6483,7 +6516,7 @@ module Aws::GuardDuty
         tracer: tracer
       )
       context[:gem_name] = 'aws-sdk-guardduty'
-      context[:gem_version] = '1.135.0'
+      context[:gem_version] = '1.136.0'
       Seahorse::Client::Request.new(handlers, context)
     end
 

data/lib/aws-sdk-guardduty/client_api.rb

@@ -56,6 +56,7 @@ module Aws::GuardDuty
     ArchiveFindingsResponse = Shapes::StructureShape.new(name: 'ArchiveFindingsResponse')
     AutoEnableMembers = Shapes::StringShape.new(name: 'AutoEnableMembers')
     AutonomousSystem = Shapes::StructureShape.new(name: 'AutonomousSystem')
+    AutoscalingAutoScalingGroup = Shapes::StructureShape.new(name: 'AutoscalingAutoScalingGroup')
     AwsApiCallAction = Shapes::StructureShape.new(name: 'AwsApiCallAction')
     BadRequestException = Shapes::StructureShape.new(name: 'BadRequestException')
     Behavior = Shapes::MapShape.new(name: 'Behavior')
@@ -66,6 +67,7 @@ module Aws::GuardDuty
     City = Shapes::StructureShape.new(name: 'City')
     ClientToken = Shapes::StringShape.new(name: 'ClientToken')
     CloudTrailConfigurationResult = Shapes::StructureShape.new(name: 'CloudTrailConfigurationResult')
+    CloudformationStack = Shapes::StructureShape.new(name: 'CloudformationStack')
     ClusterStatus = Shapes::StringShape.new(name: 'ClusterStatus')
     Condition = Shapes::StructureShape.new(name: 'Condition')
     ConflictException = Shapes::StructureShape.new(name: 'ConflictException')
@@ -194,13 +196,20 @@ module Aws::GuardDuty
     EbsVolumeDetails = Shapes::StructureShape.new(name: 'EbsVolumeDetails')
     EbsVolumeScanDetails = Shapes::StructureShape.new(name: 'EbsVolumeScanDetails')
     EbsVolumesResult = Shapes::StructureShape.new(name: 'EbsVolumesResult')
+    Ec2Image = Shapes::StructureShape.new(name: 'Ec2Image')
     Ec2ImageDetails = Shapes::StructureShape.new(name: 'Ec2ImageDetails')
     Ec2Instance = Shapes::StructureShape.new(name: 'Ec2Instance')
     Ec2InstanceUid = Shapes::StringShape.new(name: 'Ec2InstanceUid')
     Ec2InstanceUids = Shapes::ListShape.new(name: 'Ec2InstanceUids')
+    Ec2LaunchTemplate = Shapes::StructureShape.new(name: 'Ec2LaunchTemplate')
     Ec2NetworkInterface = Shapes::StructureShape.new(name: 'Ec2NetworkInterface')
     Ec2NetworkInterfaceUids = Shapes::ListShape.new(name: 'Ec2NetworkInterfaceUids')
+    Ec2Vpc = Shapes::StructureShape.new(name: 'Ec2Vpc')
+    EcsCluster = Shapes::StructureShape.new(name: 'EcsCluster')
     EcsClusterDetails = Shapes::StructureShape.new(name: 'EcsClusterDetails')
+    EcsClusterStatus = Shapes::StringShape.new(name: 'EcsClusterStatus')
+    EcsLaunchType = Shapes::StringShape.new(name: 'EcsLaunchType')
+    EcsTask = Shapes::StructureShape.new(name: 'EcsTask')
     EcsTaskDetails = Shapes::StructureShape.new(name: 'EcsTaskDetails')
     EksCluster = Shapes::StructureShape.new(name: 'EksCluster')
     EksClusterDetails = Shapes::StructureShape.new(name: 'EksClusterDetails')
@@ -296,6 +305,7 @@ module Aws::GuardDuty
     HighestSeverityThreatDetails = Shapes::StructureShape.new(name: 'HighestSeverityThreatDetails')
     HostPath = Shapes::StructureShape.new(name: 'HostPath')
     IamInstanceProfile = Shapes::StructureShape.new(name: 'IamInstanceProfile')
+    IamInstanceProfileV2 = Shapes::StructureShape.new(name: 'IamInstanceProfileV2')
     ImpersonatedUser = Shapes::StructureShape.new(name: 'ImpersonatedUser')
     IncrementalScanDetails = Shapes::StructureShape.new(name: 'IncrementalScanDetails')
     Indicator = Shapes::StructureShape.new(name: 'Indicator')
@@ -337,6 +347,7 @@ module Aws::GuardDuty
     KubernetesWorkload = Shapes::StructureShape.new(name: 'KubernetesWorkload')
     KubernetesWorkloadDetails = Shapes::StructureShape.new(name: 'KubernetesWorkloadDetails')
     LambdaDetails = Shapes::StructureShape.new(name: 'LambdaDetails')
+    LaunchTemplateVersion = Shapes::StringShape.new(name: 'LaunchTemplateVersion')
     Lineage = Shapes::ListShape.new(name: 'Lineage')
     LineageObject = Shapes::StructureShape.new(name: 'LineageObject')
     ListCoverageRequest = Shapes::StructureShape.new(name: 'ListCoverageRequest')
@@ -402,6 +413,8 @@ module Aws::GuardDuty
     ManagementType = Shapes::StringShape.new(name: 'ManagementType')
     MapEquals = Shapes::ListShape.new(name: 'MapEquals')
     Master = Shapes::StructureShape.new(name: 'Master')
+    Match = Shapes::StringShape.new(name: 'Match')
+    Matches = Shapes::ListShape.new(name: 'Matches')
     MaxResults = Shapes::IntegerShape.new(name: 'MaxResults')
     MaxResults100 = Shapes::IntegerShape.new(name: 'MaxResults100')
     Member = Shapes::StructureShape.new(name: 'Member')
@@ -431,6 +444,8 @@ module Aws::GuardDuty
     NonEmptyString = Shapes::StringShape.new(name: 'NonEmptyString')
     NonNegativeInteger = Shapes::IntegerShape.new(name: 'NonNegativeInteger')
     NotEquals = Shapes::ListShape.new(name: 'NotEquals')
+    NotMatch = Shapes::StringShape.new(name: 'NotMatch')
+    NotMatches = Shapes::ListShape.new(name: 'NotMatches')
     ObservationTexts = Shapes::ListShape.new(name: 'ObservationTexts')
     Observations = Shapes::StructureShape.new(name: 'Observations')
     OrderBy = Shapes::StringShape.new(name: 'OrderBy')
@@ -811,6 +826,9 @@ module Aws::GuardDuty
     AutonomousSystem.add_member(:number, Shapes::ShapeRef.new(shape: Integer, required: true, location_name: "number"))
     AutonomousSystem.struct_class = Types::AutonomousSystem
 
+    AutoscalingAutoScalingGroup.add_member(:ec2_instance_uids, Shapes::ShapeRef.new(shape: Ec2InstanceUids, location_name: "ec2InstanceUids"))
+    AutoscalingAutoScalingGroup.struct_class = Types::AutoscalingAutoScalingGroup
+
     AwsApiCallAction.add_member(:api, Shapes::ShapeRef.new(shape: String, location_name: "api"))
     AwsApiCallAction.add_member(:caller_type, Shapes::ShapeRef.new(shape: String, location_name: "callerType"))
     AwsApiCallAction.add_member(:domain_details, Shapes::ShapeRef.new(shape: DomainDetails, location_name: "domainDetails"))
@@ -850,6 +868,9 @@ module Aws::GuardDuty
     CloudTrailConfigurationResult.add_member(:status, Shapes::ShapeRef.new(shape: DataSourceStatus, required: true, location_name: "status"))
     CloudTrailConfigurationResult.struct_class = Types::CloudTrailConfigurationResult
 
+    CloudformationStack.add_member(:ec2_instance_uids, Shapes::ShapeRef.new(shape: Ec2InstanceUids, location_name: "ec2InstanceUids"))
+    CloudformationStack.struct_class = Types::CloudformationStack
+
     Condition.add_member(:eq, Shapes::ShapeRef.new(shape: Eq, deprecated: true, location_name: "eq"))
     Condition.add_member(:neq, Shapes::ShapeRef.new(shape: Neq, deprecated: true, location_name: "neq"))
     Condition.add_member(:gt, Shapes::ShapeRef.new(shape: Integer, deprecated: true, location_name: "gt"))
@@ -862,6 +883,8 @@ module Aws::GuardDuty
     Condition.add_member(:greater_than_or_equal, Shapes::ShapeRef.new(shape: Long, location_name: "greaterThanOrEqual"))
     Condition.add_member(:less_than, Shapes::ShapeRef.new(shape: Long, location_name: "lessThan"))
     Condition.add_member(:less_than_or_equal, Shapes::ShapeRef.new(shape: Long, location_name: "lessThanOrEqual"))
+    Condition.add_member(:matches, Shapes::ShapeRef.new(shape: Matches, location_name: "matches"))
+    Condition.add_member(:not_matches, Shapes::ShapeRef.new(shape: NotMatches, location_name: "notMatches"))
     Condition.struct_class = Types::Condition
 
     ConflictException.add_member(:message, Shapes::ShapeRef.new(shape: String, location_name: "message"))
@@ -1319,6 +1342,9 @@ module Aws::GuardDuty
     EbsVolumesResult.add_member(:reason, Shapes::ShapeRef.new(shape: String, location_name: "reason"))
     EbsVolumesResult.struct_class = Types::EbsVolumesResult
 
+    Ec2Image.add_member(:ec2_instance_uids, Shapes::ShapeRef.new(shape: Ec2InstanceUids, location_name: "ec2InstanceUids"))
+    Ec2Image.struct_class = Types::Ec2Image
+
     Ec2ImageDetails.add_member(:image_arn, Shapes::ShapeRef.new(shape: String, location_name: "imageArn"))
     Ec2ImageDetails.struct_class = Types::Ec2ImageDetails
 
@@ -1335,6 +1361,10 @@ module Aws::GuardDuty
 
     Ec2InstanceUids.member = Shapes::ShapeRef.new(shape: Ec2InstanceUid)
 
+    Ec2LaunchTemplate.add_member(:ec2_instance_uids, Shapes::ShapeRef.new(shape: Ec2InstanceUids, location_name: "ec2InstanceUids"))
+    Ec2LaunchTemplate.add_member(:version, Shapes::ShapeRef.new(shape: LaunchTemplateVersion, location_name: "Version"))
+    Ec2LaunchTemplate.struct_class = Types::Ec2LaunchTemplate
+
     Ec2NetworkInterface.add_member(:ipv_6_addresses, Shapes::ShapeRef.new(shape: Ipv6Addresses, location_name: "ipv6Addresses"))
     Ec2NetworkInterface.add_member(:private_ip_addresses, Shapes::ShapeRef.new(shape: PrivateIpAddresses, location_name: "privateIpAddresses"))
     Ec2NetworkInterface.add_member(:public_ip, Shapes::ShapeRef.new(shape: String, location_name: "publicIp"))
@@ -1345,6 +1375,13 @@ module Aws::GuardDuty
 
     Ec2NetworkInterfaceUids.member = Shapes::ShapeRef.new(shape: String)
 
+    Ec2Vpc.add_member(:ec2_instance_uids, Shapes::ShapeRef.new(shape: Ec2InstanceUids, location_name: "ec2InstanceUids"))
+    Ec2Vpc.struct_class = Types::Ec2Vpc
+
+    EcsCluster.add_member(:status, Shapes::ShapeRef.new(shape: EcsClusterStatus, location_name: "status"))
+    EcsCluster.add_member(:ec2_instance_uids, Shapes::ShapeRef.new(shape: Ec2InstanceUids, location_name: "ec2InstanceUids"))
+    EcsCluster.struct_class = Types::EcsCluster
+
     EcsClusterDetails.add_member(:name, Shapes::ShapeRef.new(shape: String, location_name: "name"))
     EcsClusterDetails.add_member(:arn, Shapes::ShapeRef.new(shape: String, location_name: "arn"))
     EcsClusterDetails.add_member(:status, Shapes::ShapeRef.new(shape: String, location_name: "status"))
@@ -1355,6 +1392,12 @@ module Aws::GuardDuty
     EcsClusterDetails.add_member(:task_details, Shapes::ShapeRef.new(shape: EcsTaskDetails, location_name: "taskDetails"))
     EcsClusterDetails.struct_class = Types::EcsClusterDetails
 
+    EcsTask.add_member(:created_at, Shapes::ShapeRef.new(shape: Timestamp, location_name: "createdAt"))
+    EcsTask.add_member(:task_definition_arn, Shapes::ShapeRef.new(shape: String, location_name: "taskDefinitionArn"))
+    EcsTask.add_member(:launch_type, Shapes::ShapeRef.new(shape: EcsLaunchType, location_name: "launchType"))
+    EcsTask.add_member(:container_uids, Shapes::ShapeRef.new(shape: ContainerUids, location_name: "containerUids"))
+    EcsTask.struct_class = Types::EcsTask
+
     EcsTaskDetails.add_member(:arn, Shapes::ShapeRef.new(shape: String, location_name: "arn"))
     EcsTaskDetails.add_member(:definition_arn, Shapes::ShapeRef.new(shape: String, location_name: "definitionArn"))
     EcsTaskDetails.add_member(:version, Shapes::ShapeRef.new(shape: String, location_name: "version"))
@@ -1715,6 +1758,9 @@ module Aws::GuardDuty
     IamInstanceProfile.add_member(:id, Shapes::ShapeRef.new(shape: String, location_name: "id"))
     IamInstanceProfile.struct_class = Types::IamInstanceProfile
 
+    IamInstanceProfileV2.add_member(:ec2_instance_uids, Shapes::ShapeRef.new(shape: Ec2InstanceUids, location_name: "ec2InstanceUids"))
+    IamInstanceProfileV2.struct_class = Types::IamInstanceProfileV2
+
     ImpersonatedUser.add_member(:username, Shapes::ShapeRef.new(shape: String, location_name: "username"))
     ImpersonatedUser.add_member(:groups, Shapes::ShapeRef.new(shape: Groups, location_name: "groups"))
     ImpersonatedUser.struct_class = Types::ImpersonatedUser
@@ -2104,6 +2150,8 @@ module Aws::GuardDuty
     Master.add_member(:invited_at, Shapes::ShapeRef.new(shape: String, location_name: "invitedAt"))
     Master.struct_class = Types::Master
 
+    Matches.member = Shapes::ShapeRef.new(shape: Match)
+
     Member.add_member(:account_id, Shapes::ShapeRef.new(shape: AccountId, required: true, location_name: "accountId"))
     Member.add_member(:detector_id, Shapes::ShapeRef.new(shape: DetectorId, location_name: "detectorId"))
     Member.add_member(:master_id, Shapes::ShapeRef.new(shape: String, required: true, location_name: "masterId"))
@@ -2201,6 +2249,8 @@ module Aws::GuardDuty
 
     NotEquals.member = Shapes::ShapeRef.new(shape: String)
 
+    NotMatches.member = Shapes::ShapeRef.new(shape: NotMatch)
+
     ObservationTexts.member = Shapes::ShapeRef.new(shape: String)
 
     Observations.add_member(:text, Shapes::ShapeRef.new(shape: ObservationTexts, location_name: "text"))
@@ -2440,6 +2490,14 @@ module Aws::GuardDuty
     ResourceData.add_member(:eks_cluster, Shapes::ShapeRef.new(shape: EksCluster, location_name: "eksCluster"))
     ResourceData.add_member(:kubernetes_workload, Shapes::ShapeRef.new(shape: KubernetesWorkload, location_name: "kubernetesWorkload"))
     ResourceData.add_member(:container, Shapes::ShapeRef.new(shape: ContainerFindingResource, location_name: "container"))
+    ResourceData.add_member(:ecs_cluster, Shapes::ShapeRef.new(shape: EcsCluster, location_name: "ecsCluster"))
+    ResourceData.add_member(:ecs_task, Shapes::ShapeRef.new(shape: EcsTask, location_name: "ecsTask"))
+    ResourceData.add_member(:iam_instance_profile, Shapes::ShapeRef.new(shape: IamInstanceProfileV2, location_name: "iamInstanceProfile"))
+    ResourceData.add_member(:autoscaling_auto_scaling_group, Shapes::ShapeRef.new(shape: AutoscalingAutoScalingGroup, location_name: "autoscalingAutoScalingGroup"))
+    ResourceData.add_member(:ec2_launch_template, Shapes::ShapeRef.new(shape: Ec2LaunchTemplate, location_name: "ec2LaunchTemplate"))
+    ResourceData.add_member(:ec2_vpc, Shapes::ShapeRef.new(shape: Ec2Vpc, location_name: "ec2Vpc"))
+    ResourceData.add_member(:ec2_image, Shapes::ShapeRef.new(shape: Ec2Image, location_name: "ec2Image"))
+    ResourceData.add_member(:cloudformation_stack, Shapes::ShapeRef.new(shape: CloudformationStack, location_name: "cloudformationStack"))
     ResourceData.struct_class = Types::ResourceData
 
     ResourceDetails.add_member(:instance_arn, Shapes::ShapeRef.new(shape: InstanceArn, location_name: "instanceArn"))

data/lib/aws-sdk-guardduty/types.rb

@@ -632,6 +632,23 @@ module Aws::GuardDuty
       include Aws::Structure
     end
 
+    # Contains information about the Auto Scaling Group involved in a
+    # GuardDuty finding, including unique identifiers of the Amazon EC2
+    # instances.
+    #
+    # @!attribute [rw] ec2_instance_uids
+    #   A list of unique identifiers for the compromised Amazon EC2
+    #   instances that are part of the same Auto Scaling Group.
+    #   @return [Array<String>]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/guardduty-2017-11-28/AutoscalingAutoScalingGroup AWS API Documentation
+    #
+    class AutoscalingAutoScalingGroup < Struct.new(
+      :ec2_instance_uids)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
     # Contains information about the API action.
     #
     # @!attribute [rw] api
@@ -824,6 +841,24 @@ module Aws::GuardDuty
       include Aws::Structure
     end
 
+    # Contains information about the CloudFormation stack involved in a
+    # GuardDuty finding, including unique identifiers of the Amazon EC2
+    # instances.
+    #
+    # @!attribute [rw] ec2_instance_uids
+    #   A list of unique identifiers for the compromised Amazon EC2
+    #   instances that were created as part of the same CloudFormation
+    #   stack.
+    #   @return [Array<String>]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/guardduty-2017-11-28/CloudformationStack AWS API Documentation
+    #
+    class CloudformationStack < Struct.new(
+      :ec2_instance_uids)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
     # Contains information about the condition.
     #
     # @!attribute [rw] eq
@@ -886,6 +921,26 @@ module Aws::GuardDuty
     #   single field when querying for findings.
     #   @return [Integer]
     #
+    # @!attribute [rw] matches
+    #   Represents the *match* condition to be applied to a single field
+    #   when querying for findings.
+    #
+    #   <note markdown="1"> The *matches* condition is available only for create-filter and
+    #   update-filter APIs.
+    #
+    #    </note>
+    #   @return [Array<String>]
+    #
+    # @!attribute [rw] not_matches
+    #   Represents the *not match* condition to be applied to a single field
+    #   when querying for findings.
+    #
+    #   <note markdown="1"> The *not-matches* condition is available only for create-filter and
+    #   update-filter APIs.
+    #
+    #    </note>
+    #   @return [Array<String>]
+    #
     # @see http://docs.aws.amazon.com/goto/WebAPI/guardduty-2017-11-28/Condition AWS API Documentation
     #
     class Condition < Struct.new(
@@ -900,7 +955,9 @@ module Aws::GuardDuty
       :greater_than,
       :greater_than_or_equal,
       :less_than,
-      :less_than_or_equal)
+      :less_than_or_equal,
+      :matches,
+      :not_matches)
       SENSITIVE = []
       include Aws::Structure
     end
@@ -3419,6 +3476,24 @@ module Aws::GuardDuty
       include Aws::Structure
     end
 
+    # Contains information about the Amazon EC2 Image involved in a
+    # GuardDuty finding, including unique identifiers of the Amazon EC2
+    # instances.
+    #
+    # @!attribute [rw] ec2_instance_uids
+    #   A list of unique identifiers for the compromised Amazon EC2
+    #   instances that were launched with the same Amazon Machine Image
+    #   (AMI).
+    #   @return [Array<String>]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/guardduty-2017-11-28/Ec2Image AWS API Documentation
+    #
+    class Ec2Image < Struct.new(
+      :ec2_instance_uids)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
     # Contains details about the EC2 AMI that was scanned.
     #
     # @!attribute [rw] image_arn
@@ -3500,6 +3575,28 @@ module Aws::GuardDuty
       include Aws::Structure
     end
 
+    # Contains information about the Amazon EC2 launch template involved in
+    # a GuardDuty finding, including unique identifiers of the Amazon EC2
+    # instances.
+    #
+    # @!attribute [rw] ec2_instance_uids
+    #   A list of unique identifiers for the compromised Amazon EC2
+    #   instances that share the same Amazon EC2 launch template.
+    #   @return [Array<String>]
+    #
+    # @!attribute [rw] version
+    #   Version of the EC2 launch template.
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/guardduty-2017-11-28/Ec2LaunchTemplate AWS API Documentation
+    #
+    class Ec2LaunchTemplate < Struct.new(
+      :ec2_instance_uids,
+      :version)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
     # Contains information about the elastic network interface of the Amazon
     # EC2 instance.
     #
@@ -3540,6 +3637,44 @@ module Aws::GuardDuty
       include Aws::Structure
     end
 
+    # Contains information about the Amazon EC2 VPC involved in a GuardDuty
+    # finding, including unique identifiers of the Amazon EC2 instances.
+    #
+    # @!attribute [rw] ec2_instance_uids
+    #   A list of unique identifiers for the compromised Amazon EC2
+    #   instances that were launched within the same Virtual Private Cloud
+    #   (VPC).
+    #   @return [Array<String>]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/guardduty-2017-11-28/Ec2Vpc AWS API Documentation
+    #
+    class Ec2Vpc < Struct.new(
+      :ec2_instance_uids)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
+    # Contains information about the Amazon ECS cluster involved in a
+    # GuardDuty finding, including cluster identification and status.
+    #
+    # @!attribute [rw] status
+    #   The current status of the Amazon ECS cluster.
+    #   @return [String]
+    #
+    # @!attribute [rw] ec2_instance_uids
+    #   A list of unique identifiers for the Amazon EC2 instances that serve
+    #   as container instances in the Amazon ECS cluster.
+    #   @return [Array<String>]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/guardduty-2017-11-28/EcsCluster AWS API Documentation
+    #
+    class EcsCluster < Struct.new(
+      :status,
+      :ec2_instance_uids)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
     # Contains information about the details of the ECS Cluster.
     #
     # @!attribute [rw] name
@@ -3590,6 +3725,39 @@ module Aws::GuardDuty
       include Aws::Structure
     end
 
+    # Contains information about Amazon ECS task involved in a GuardDuty
+    # finding, including task definition and container identifiers.
+    #
+    # @!attribute [rw] created_at
+    #   The timestamp indicating when the Amazon ECS task was created, in
+    #   UTC format.
+    #   @return [Time]
+    #
+    # @!attribute [rw] task_definition_arn
+    #   The ARN of task definition which describes the container and volume
+    #   definitions of the Amazon ECS task.
+    #   @return [String]
+    #
+    # @!attribute [rw] launch_type
+    #   The infrastructure type on which the Amazon ECS task runs.
+    #   @return [String]
+    #
+    # @!attribute [rw] container_uids
+    #   A list of unique identifiers for the containers associated with the
+    #   Amazon ECS task.
+    #   @return [Array<String>]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/guardduty-2017-11-28/EcsTask AWS API Documentation
+    #
+    class EcsTask < Struct.new(
+      :created_at,
+      :task_definition_arn,
+      :launch_type,
+      :container_uids)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
     # Contains information about the task in an ECS cluster.
     #
     # @!attribute [rw] arn
@@ -5314,6 +5482,23 @@ module Aws::GuardDuty
       include Aws::Structure
     end
 
+    # Contains information about the IAM instance profile involved in a
+    # GuardDuty finding, including unique identifiers of the Amazon EC2
+    # instances.
+    #
+    # @!attribute [rw] ec2_instance_uids
+    #   A list of unique identifiers for the compromised Amazon EC2
+    #   instances that share the same IAM instance profile.
+    #   @return [Array<String>]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/guardduty-2017-11-28/IamInstanceProfileV2 AWS API Documentation
+    #
+    class IamInstanceProfileV2 < Struct.new(
+      :ec2_instance_uids)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
     # Contains information about the impersonated user.
     #
     # @!attribute [rw] username
@@ -8948,6 +9133,51 @@ module Aws::GuardDuty
     #   the activity that prompted GuardDuty to generate a finding.
     #   @return [Types::ContainerFindingResource]
     #
+    # @!attribute [rw] ecs_cluster
+    #   Contains detailed information about the Amazon ECS cluster
+    #   associated with the activity that prompted GuardDuty to generate a
+    #   finding.
+    #   @return [Types::EcsCluster]
+    #
+    # @!attribute [rw] ecs_task
+    #   Contains detailed information about the Amazon ECS task associated
+    #   with the activity that prompted GuardDuty to generate a finding.
+    #   @return [Types::EcsTask]
+    #
+    # @!attribute [rw] iam_instance_profile
+    #   Contains detailed information about the IAM instance profile
+    #   associated with the activity that prompted GuardDuty to generate a
+    #   finding.
+    #   @return [Types::IamInstanceProfileV2]
+    #
+    # @!attribute [rw] autoscaling_auto_scaling_group
+    #   Contains detailed information about the Auto Scaling Group
+    #   associated with the activity that prompted GuardDuty to generate a
+    #   finding.
+    #   @return [Types::AutoscalingAutoScalingGroup]
+    #
+    # @!attribute [rw] ec2_launch_template
+    #   Contains detailed information about the EC2 launch template
+    #   associated with the activity that prompted GuardDuty to generate a
+    #   finding.
+    #   @return [Types::Ec2LaunchTemplate]
+    #
+    # @!attribute [rw] ec2_vpc
+    #   Contains detailed information about the EC2 VPC associated with the
+    #   activity that prompted GuardDuty to generate a finding.
+    #   @return [Types::Ec2Vpc]
+    #
+    # @!attribute [rw] ec2_image
+    #   Contains detailed information about the EC2 Image associated with
+    #   the activity that prompted GuardDuty to generate a finding.
+    #   @return [Types::Ec2Image]
+    #
+    # @!attribute [rw] cloudformation_stack
+    #   Contains detailed information about the CloudFormation stack
+    #   associated with the activity that prompted GuardDuty to generate a
+    #   finding.
+    #   @return [Types::CloudformationStack]
+    #
     # @see http://docs.aws.amazon.com/goto/WebAPI/guardduty-2017-11-28/ResourceData AWS API Documentation
     #
     class ResourceData < Struct.new(
@@ -8958,7 +9188,15 @@ module Aws::GuardDuty
       :s3_object,
       :eks_cluster,
       :kubernetes_workload,
-      :container)
+      :container,
+      :ecs_cluster,
+      :ecs_task,
+      :iam_instance_profile,
+      :autoscaling_auto_scaling_group,
+      :ec2_launch_template,
+      :ec2_vpc,
+      :ec2_image,
+      :cloudformation_stack)
       SENSITIVE = []
       include Aws::Structure
     end

data/lib/aws-sdk-guardduty.rb

@@ -54,7 +54,7 @@ module Aws::GuardDuty
   autoload :EndpointProvider, 'aws-sdk-guardduty/endpoint_provider'
   autoload :Endpoints, 'aws-sdk-guardduty/endpoints'
 
-  GEM_VERSION = '1.135.0'
+  GEM_VERSION = '1.136.0'
 
 end
 

data/sig/client.rbs

@@ -175,7 +175,9 @@ module Aws
                                  greater_than: ::Integer?,
                                  greater_than_or_equal: ::Integer?,
                                  less_than: ::Integer?,
-                                 less_than_or_equal: ::Integer?
+                                 less_than_or_equal: ::Integer?,
+                                 matches: Array[::String]?,
+                                 not_matches: Array[::String]?
                                }]?
                            },
                            ?client_token: ::String,
@@ -634,7 +636,9 @@ module Aws
                                            greater_than: ::Integer?,
                                            greater_than_or_equal: ::Integer?,
                                            less_than: ::Integer?,
-                                           less_than_or_equal: ::Integer?
+                                           less_than_or_equal: ::Integer?,
+                                           matches: Array[::String]?,
+                                           not_matches: Array[::String]?
                                          }]?
                                      },
                                      ?group_by: ("ACCOUNT" | "DATE" | "FINDING_TYPE" | "RESOURCE" | "SEVERITY"),
@@ -938,7 +942,9 @@ module Aws
                                  greater_than: ::Integer?,
                                  greater_than_or_equal: ::Integer?,
                                  less_than: ::Integer?,
-                                 less_than_or_equal: ::Integer?
+                                 less_than_or_equal: ::Integer?,
+                                 matches: Array[::String]?,
+                                 not_matches: Array[::String]?
                                }]?
                            },
                            ?sort_criteria: {
@@ -1249,7 +1255,9 @@ module Aws
                                  greater_than: ::Integer?,
                                  greater_than_or_equal: ::Integer?,
                                  less_than: ::Integer?,
-                                 less_than_or_equal: ::Integer?
+                                 less_than_or_equal: ::Integer?,
+                                 matches: Array[::String]?,
+                                 not_matches: Array[::String]?
                                }]?
                            }
                          ) -> _UpdateFilterResponseSuccess

data/sig/types.rbs

@@ -179,6 +179,11 @@ module Aws::GuardDuty
       SENSITIVE: []
     end
 
+    class AutoscalingAutoScalingGroup
+      attr_accessor ec2_instance_uids: ::Array[::String]
+      SENSITIVE: []
+    end
+
     class AwsApiCallAction
       attr_accessor api: ::String
       attr_accessor caller_type: ::String
@@ -229,6 +234,11 @@ module Aws::GuardDuty
       SENSITIVE: []
     end
 
+    class CloudformationStack
+      attr_accessor ec2_instance_uids: ::Array[::String]
+      SENSITIVE: []
+    end
+
     class Condition
       attr_accessor eq: ::Array[::String]
       attr_accessor neq: ::Array[::String]
@@ -242,6 +252,8 @@ module Aws::GuardDuty
       attr_accessor greater_than_or_equal: ::Integer
       attr_accessor less_than: ::Integer
       attr_accessor less_than_or_equal: ::Integer
+      attr_accessor matches: ::Array[::String]
+      attr_accessor not_matches: ::Array[::String]
       SENSITIVE: []
     end
 
@@ -839,6 +851,11 @@ module Aws::GuardDuty
       SENSITIVE: []
     end
 
+    class Ec2Image
+      attr_accessor ec2_instance_uids: ::Array[::String]
+      SENSITIVE: []
+    end
+
     class Ec2ImageDetails
       attr_accessor image_arn: ::String
       SENSITIVE: []
@@ -857,6 +874,12 @@ module Aws::GuardDuty
       SENSITIVE: []
     end
 
+    class Ec2LaunchTemplate
+      attr_accessor ec2_instance_uids: ::Array[::String]
+      attr_accessor version: ::String
+      SENSITIVE: []
+    end
+
     class Ec2NetworkInterface
       attr_accessor ipv_6_addresses: ::Array[::String]
       attr_accessor private_ip_addresses: ::Array[Types::PrivateIpAddressDetails]
@@ -867,6 +890,17 @@ module Aws::GuardDuty
       SENSITIVE: []
     end
 
+    class Ec2Vpc
+      attr_accessor ec2_instance_uids: ::Array[::String]
+      SENSITIVE: []
+    end
+
+    class EcsCluster
+      attr_accessor status: ("ACTIVE" | "PROVISIONING" | "DEPROVISIONING" | "FAILED" | "INACTIVE")
+      attr_accessor ec2_instance_uids: ::Array[::String]
+      SENSITIVE: []
+    end
+
     class EcsClusterDetails
       attr_accessor name: ::String
       attr_accessor arn: ::String
@@ -879,6 +913,14 @@ module Aws::GuardDuty
       SENSITIVE: []
     end
 
+    class EcsTask
+      attr_accessor created_at: ::Time
+      attr_accessor task_definition_arn: ::String
+      attr_accessor launch_type: ("FARGATE" | "EC2")
+      attr_accessor container_uids: ::Array[::String]
+      SENSITIVE: []
+    end
+
     class EcsTaskDetails
       attr_accessor arn: ::String
       attr_accessor definition_arn: ::String
@@ -1321,6 +1363,11 @@ module Aws::GuardDuty
       SENSITIVE: []
     end
 
+    class IamInstanceProfileV2
+      attr_accessor ec2_instance_uids: ::Array[::String]
+      SENSITIVE: []
+    end
+
     class ImpersonatedUser
       attr_accessor username: ::String
       attr_accessor groups: ::Array[::String]
@@ -2223,6 +2270,14 @@ module Aws::GuardDuty
       attr_accessor eks_cluster: Types::EksCluster
       attr_accessor kubernetes_workload: Types::KubernetesWorkload
       attr_accessor container: Types::ContainerFindingResource
+      attr_accessor ecs_cluster: Types::EcsCluster
+      attr_accessor ecs_task: Types::EcsTask
+      attr_accessor iam_instance_profile: Types::IamInstanceProfileV2
+      attr_accessor autoscaling_auto_scaling_group: Types::AutoscalingAutoScalingGroup
+      attr_accessor ec2_launch_template: Types::Ec2LaunchTemplate
+      attr_accessor ec2_vpc: Types::Ec2Vpc
+      attr_accessor ec2_image: Types::Ec2Image
+      attr_accessor cloudformation_stack: Types::CloudformationStack
       SENSITIVE: []
     end
 
@@ -2250,7 +2305,7 @@ module Aws::GuardDuty
       attr_accessor uid: ::String
       attr_accessor name: ::String
       attr_accessor account_id: ::String
-      attr_accessor resource_type: ("EC2_INSTANCE" | "EC2_NETWORK_INTERFACE" | "S3_BUCKET" | "S3_OBJECT" | "ACCESS_KEY" | "EKS_CLUSTER" | "KUBERNETES_WORKLOAD" | "CONTAINER")
+      attr_accessor resource_type: ("EC2_INSTANCE" | "EC2_NETWORK_INTERFACE" | "S3_BUCKET" | "S3_OBJECT" | "ACCESS_KEY" | "EKS_CLUSTER" | "KUBERNETES_WORKLOAD" | "CONTAINER" | "ECS_CLUSTER" | "ECS_TASK" | "AUTOSCALING_AUTO_SCALING_GROUP" | "IAM_INSTANCE_PROFILE" | "CLOUDFORMATION_STACK" | "EC2_LAUNCH_TEMPLATE" | "EC2_VPC" | "EC2_IMAGE")
       attr_accessor region: ::String
       attr_accessor service: ::String
       attr_accessor cloud_partition: ::String

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: aws-sdk-guardduty
 version: !ruby/object:Gem::Version
-  version: 1.135.0
+  version: 1.136.0
 platform: ruby
 authors:
 - Amazon Web Services