GuardDuty: the resource type picks which block is filled

One type, one block

A finding’s resource object has a type and then the details for that type. An access-key type fills the access-key details. An instance type fills the instance details. A bucket type fills the bucket details. The other blocks are empty or absent because they are not this finding’s resource.

Reading an empty block as “no instance existed” or “no key was involved” overclaims. The empty block means this finding did not describe that kind of resource.

Copy fields from the filled block

Write ResourceType, then the fields inside the matching block: a key id, an instance id, or a bucket name, whichever the type names. Leave the other names off the note. If you need a fact that lives in a different block, you need a different finding or a different log, and you cite that.

The actor fields you may have learned elsewhere still have to sit in the block this type filled. Do not drag them across from an empty block.

What to file

File the finding id, ResourceType, and the identifier from the matching block. If that block is missing even though the type names it, write “matching block absent.” Do not backfill from a different block to hide the gap.

Worked case: an instance id on a key finding

A sandbox finding has ResourceType AccessKey and a key id in the access-key block. The instance block is absent. A draft adds instance id i-0abc from a different finding on the same account and says this finding is about that instance.

The note quotes AccessKey and the key id. It says the instance block was absent, so no instance id is on this finding. The other finding keeps its own id. The draft’s instance line is removed from this note.

finding: <id>
ResourceType: AccessKey
access-key block: key id present
instance block: absent
other finding's instance id: not this note
write: this finding's resource is the key