GuardDuty: the account id is not the detector id

The account id is twelve digits

The AccountId field is the account number on the finding, twelve digits. It says which account the detector reported. It is not the detector’s id, and it is not the finding id.

A second account in the organization has its own number. Matching the first few digits is not the same account. Copy the whole field.

The detector id opens the finding

The detector id is the identifier of the GuardDuty detector in that region. Commands that fetch the finding take the detector id, not the account number. Using the account number in that position looks up a detector that does not exist.

If the paste has an account number and no detector id, write “detector id not copied.” Do not invent one from the account.

What to file

File AccountId, the detector id, the region, and the finding id as four fields. Label each one. A sentence that says “the account” uses AccountId. A sentence that says “open the finding” uses the detector id and the region.

Worked case: an account number passed as the detector

A sandbox finding shows AccountId 111122223333 and detector det-lab1 in us-east-1. A teammate runs the get command with 111122223333 as the detector id, gets an error, and writes that the finding was removed.

The note keeps 111122223333 as the account and det-lab1 as the detector. The error is the wrong id in the detector position. The finding is not described as removed.

AccountId: 111122223333
detector: det-lab1
Region: us-east-1
command that failed: detector id set to the account number
write: two different ids
not: the finding was removed