GuardDuty ECS Runtime Monitoring should be enabled

How to fix it

• Interrupts service: Tasks already running stay unmonitored until replaced, so each ECS service needs a new deployment, which restarts its tasks.
• Affects another check: This also passes GuardDuty.7 and GuardDuty.11, but GuardDuty.13 keeps failing until automated agent configuration is on for EC2 too.
• Can break clients: Automated agent configuration adds a GuardDuty VPC endpoint and security group to monitored VPCs, which blocks IaC deleting those subnets before Terraform AWS provider 6.43.0.

In the console

GuardDuty → Protection plans → Runtime Monitoring → Configuration

Runtime Monitoring

Enable

Automated agent configuration

Enable for AWS Fargate (ECS only), so GuardDuty adds the agent as a sidecar to each new task

Task execution role

One with ECR pull permissions, such as AmazonECSTaskExecutionRolePolicy, or the sidecar cannot start

With the AWS CLI

aws guardduty update-detector --detector-id <detector-id> --region <region> --features '[{"Name":"RUNTIME_MONITORING","Status":"ENABLED","AdditionalConfiguration":[{"Name":"ECS_FARGATE_AGENT_MANAGEMENT","Status":"ENABLED"}]}]'

With Terraform

resource "aws_guardduty_detector_feature" "this" {
  detector_id = aws_guardduty_detector.this.id
  name        = "RUNTIME_MONITORING"
  status      = "ENABLED"

  additional_configuration {
    name   = "ECS_FARGATE_AGENT_MANAGEMENT"
    status = "ENABLED"
  }
}