GuardDuty EC2 Runtime Monitoring should be enabled

How to fix it

• Affects another check: This also passes GuardDuty.7 and GuardDuty.11, and the agent reaches only instances Systems Manager manages, so an instance failing SSM.1 stays unmonitored.
• Can break clients: Automated agent configuration adds a GuardDuty VPC endpoint and security group to monitored VPCs, which blocks IaC deleting those subnets before Terraform AWS provider 6.43.0.

In the console

GuardDuty → Protection plans → Runtime Monitoring → Configuration

Runtime Monitoring

Enable

Automated agent configuration

Enable in the EC2 section, so GuardDuty installs and updates the agent through Systems Manager

With the AWS CLI

aws guardduty update-detector --detector-id <detector-id> --region <region> --features '[{"Name":"RUNTIME_MONITORING","Status":"ENABLED","AdditionalConfiguration":[{"Name":"EC2_AGENT_MANAGEMENT","Status":"ENABLED"}]}]'

With Terraform

resource "aws_guardduty_detector_feature" "this" {
  detector_id = aws_guardduty_detector.this.id
  name        = "RUNTIME_MONITORING"
  status      = "ENABLED"

  additional_configuration {
    name   = "EC2_AGENT_MANAGEMENT"
    status = "ENABLED"
  }
}