disable_guardduty_eks_support_org_wide.sh

#!/bin/bash

# Disables EKS features of GuardDuty that have been automatically enabled.

# Run from the account that is your GuardDuty delegated admin account.
# Assumes that GuardDuty is enabled in all regions with a single detector and that auto-enable is turned on.
# If it isn't on in all regions you may need to adjust how you populate the list or regions.
# If you don't want auto-enable turned on change --auto-enable to --no-auto-enable
# If you have multiple detectors, I leave it as an excercise to the reader to deal with that.
# xargs is used since update-member-detectors has an apparent limit of 12 accounts per call

for region in $(aws ec2 describe-regions --query 'Regions[*].RegionName' --output text); do
  detector_id=$(aws guardduty list-detectors --output text --query 'DetectorIds[0]' --region "$region")
  aws guardduty update-organization-configuration --detector-id "$detector_id" --auto-enable --data-sources='Kubernetes={AuditLogs={AutoEnable=false}}' --region "$region";
  aws guardduty list-members --detector-id "$detector_id" --region "$region" --query 'Members[*].AccountId' --output text | xargs -n12 aws guardduty update-member-detectors --detector-id "$detector_id" --region "$region" --data-sources='Kubernetes={AuditLogs={Enable=false}}' --account-ids
done

Now that AWS is going to disable it for everyone and you'll have to enable it, if you want to use this script to enable it for all regions/accounts. Just change the 2 instances of false in the script to true.