aws-sdk-guardduty 1.152.0 → 1.153.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d502c850ab12f48dc216cf03843b4abe72bb3b669c17d28143fd17fc541360ab
-  data.tar.gz: 0d4e8b59300ba19ff626e9181cacc80414dc7cc324e1a5000f71096892db5d2d
+  metadata.gz: f6adcc24edb8288ec2a463559ce6322630686396de0fc99c1cdbdda4054d63bb
+  data.tar.gz: d23a697f2f89452fb21ed7e0723895483a55ef02e1cb8545507b6bde634e312b
 SHA512:
-  metadata.gz: 29e5f596e7279a277678b29755217884a14939f2689f5e0867e8844120c8ae6196dbbd45acae87e72fe9a025793d536a8d0b4eb8c5baa8d6e0cea848f171d74b
-  data.tar.gz: 01be69ae980d58697d77aeed318c8a4c9992ac716d2afe6263e3eb4f4e3fd3e0d1c1cdb163566c3573c27d3efd277742c1b220b2d9c3b61bc74ce41a8356ac06
+  metadata.gz: c523d3a7e9ef6a92c06ad91e2aba0b46ccf4c7cd80d3e1b5704914b4a74d77d3325ec31404f7e68b493ab29ba9a5d3c05b20bb71c5216170614111fae62a411f
+  data.tar.gz: 1cc71c945575b1e223b8f2b3f9b07debfd348729bd75a13e93d64d897bc1cd53e538a06d1b810b7747c9b0efa353571aa8bbd5340bd5a36aa91338e299a2a403

data/CHANGELOG.md

@@ -1,6 +1,11 @@
 Unreleased Changes
 ------------------
 
+1.153.0 (2026-06-02)
+------------------
+
+* Feature - Amazon GuardDuty Runtime Monitoring now supports 3 new SensitiveFileModified finding types (Persistence, PrivilegeEscalation, DefenseEvasion) that detect when security-sensitive system files are modified on EC2 instances or containers, indicating potential compromise through file tampering.
+
 1.152.0 (2026-05-26)
 ------------------
 

data/VERSION

@@ -1 +1 @@
-1.152.0
+1.153.0

data/lib/aws-sdk-guardduty/client.rb

@@ -4303,6 +4303,10 @@ module Aws::GuardDuty
     #   resp.findings[0].service.runtime_details.context.service_name #=> String
     #   resp.findings[0].service.runtime_details.context.command_line_example #=> String
     #   resp.findings[0].service.runtime_details.context.threat_file_path #=> String
+    #   resp.findings[0].service.runtime_details.context.file_operation #=> String
+    #   resp.findings[0].service.runtime_details.context.file_path #=> String
+    #   resp.findings[0].service.runtime_details.context.related_file_paths #=> Array
+    #   resp.findings[0].service.runtime_details.context.related_file_paths[0] #=> String
     #   resp.findings[0].service.detection.anomaly.profiles #=> Hash
     #   resp.findings[0].service.detection.anomaly.profiles["String"] #=> Hash
     #   resp.findings[0].service.detection.anomaly.profiles["String"]["String"] #=> Array
@@ -8968,7 +8972,7 @@ module Aws::GuardDuty
         tracer: tracer
       )
       context[:gem_name] = 'aws-sdk-guardduty'
-      context[:gem_version] = '1.152.0'
+      context[:gem_version] = '1.153.0'
       Seahorse::Client::Request.new(handlers, context)
     end
 

data/lib/aws-sdk-guardduty/client_api.rb

@@ -510,6 +510,7 @@ module Aws::GuardDuty
     RdsLoginAttemptAction = Shapes::StructureShape.new(name: 'RdsLoginAttemptAction')
     RecoveryPoint = Shapes::StructureShape.new(name: 'RecoveryPoint')
     RecoveryPointDetails = Shapes::StructureShape.new(name: 'RecoveryPointDetails')
+    RelatedFilePathsList = Shapes::ListShape.new(name: 'RelatedFilePathsList')
     RemoteAccountDetails = Shapes::StructureShape.new(name: 'RemoteAccountDetails')
     RemoteIpDetails = Shapes::StructureShape.new(name: 'RemoteIpDetails')
     RemotePortDetails = Shapes::StructureShape.new(name: 'RemotePortDetails')
@@ -2456,6 +2457,8 @@ module Aws::GuardDuty
     RecoveryPointDetails.add_member(:backup_vault_name, Shapes::ShapeRef.new(shape: String, location_name: "backupVaultName"))
     RecoveryPointDetails.struct_class = Types::RecoveryPointDetails
 
+    RelatedFilePathsList.member = Shapes::ShapeRef.new(shape: String)
+
     RemoteAccountDetails.add_member(:account_id, Shapes::ShapeRef.new(shape: String, location_name: "accountId"))
     RemoteAccountDetails.add_member(:affiliated, Shapes::ShapeRef.new(shape: Boolean, location_name: "affiliated"))
     RemoteAccountDetails.struct_class = Types::RemoteAccountDetails
@@ -2564,6 +2567,9 @@ module Aws::GuardDuty
     RuntimeContext.add_member(:service_name, Shapes::ShapeRef.new(shape: String, location_name: "serviceName"))
     RuntimeContext.add_member(:command_line_example, Shapes::ShapeRef.new(shape: String, location_name: "commandLineExample"))
     RuntimeContext.add_member(:threat_file_path, Shapes::ShapeRef.new(shape: String, location_name: "threatFilePath"))
+    RuntimeContext.add_member(:file_operation, Shapes::ShapeRef.new(shape: String, location_name: "fileOperation"))
+    RuntimeContext.add_member(:file_path, Shapes::ShapeRef.new(shape: String, location_name: "filePath"))
+    RuntimeContext.add_member(:related_file_paths, Shapes::ShapeRef.new(shape: RelatedFilePathsList, location_name: "relatedFilePaths"))
     RuntimeContext.struct_class = Types::RuntimeContext
 
     RuntimeDetails.add_member(:process, Shapes::ShapeRef.new(shape: ProcessDetails, location_name: "process"))

data/lib/aws-sdk-guardduty/types.rb

@@ -10654,6 +10654,22 @@ module Aws::GuardDuty
     #   were found.
     #   @return [String]
     #
+    # @!attribute [rw] file_operation
+    #   Represents the type of file operation that triggered the finding,
+    #   such as Write, Delete, Rename, Link, or Symlink.
+    #   @return [String]
+    #
+    # @!attribute [rw] file_path
+    #   The path of the sensitive file that was modified. Modification
+    #   includes write, delete, rename, link, or symlink operations. This
+    #   field is indexed for filtering.
+    #   @return [String]
+    #
+    # @!attribute [rw] related_file_paths
+    #   All file paths modified by the same process that triggered the
+    #   finding, up to a maximum of 25 paths.
+    #   @return [Array<String>]
+    #
     # @see http://docs.aws.amazon.com/goto/WebAPI/guardduty-2017-11-28/RuntimeContext AWS API Documentation
     #
     class RuntimeContext < Struct.new(
@@ -10681,7 +10697,10 @@ module Aws::GuardDuty
       :tool_category,
       :service_name,
       :command_line_example,
-      :threat_file_path)
+      :threat_file_path,
+      :file_operation,
+      :file_path,
+      :related_file_paths)
       SENSITIVE = []
       include Aws::Structure
     end

data/lib/aws-sdk-guardduty.rb

@@ -54,7 +54,7 @@ module Aws::GuardDuty
   autoload :EndpointProvider, 'aws-sdk-guardduty/endpoint_provider'
   autoload :Endpoints, 'aws-sdk-guardduty/endpoints'
 
-  GEM_VERSION = '1.152.0'
+  GEM_VERSION = '1.153.0'
 
 end
 

data/sig/types.rbs

@@ -2348,6 +2348,9 @@ module Aws::GuardDuty
       attr_accessor service_name: ::String
       attr_accessor command_line_example: ::String
       attr_accessor threat_file_path: ::String
+      attr_accessor file_operation: ::String
+      attr_accessor file_path: ::String
+      attr_accessor related_file_paths: ::Array[::String]
       SENSITIVE: []
     end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: aws-sdk-guardduty
 version: !ruby/object:Gem::Version
-  version: 1.152.0
+  version: 1.153.0
 platform: ruby
 authors:
 - Amazon Web Services