Add Organisation feature 'auto-enable'

[kierang-contino]

Have a question? Please checkout our Slack Community or visit our Slack Archive.

Describe the Feature

A toggle should be provided that is used on the delegated administrator account that activates AWS Organization Auto-enable feature for GuardDuty. Thus all new accounts have GuardDuty automatically enabled and send data to the delegated admin account.

Expected Behavior

A single deployment of this module in the security account during the early stages of the landing zone creation should be sufficient to manage all accounts in the org via that security account.

Use Case

The GuardDuty delegated admin account is able to see and control the GuardDuty deployment of other accounts in the AWS Organization.

Describe Ideal Solution

A single toggle should be set to true on the delegated admin account and then there is no need for this module to be deployed in any other account.

Alternatives Considered

Users can manually enable this feature via the console.

Additional Context

• https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_organizations.html
• PR incoming