GuardDuty EKS Runtime Monitoring should be enabled

How to fix it

• Affects another check: This also passes GuardDuty.11, but GuardDuty.12 and GuardDuty.13 keep failing until automated agent configuration is on for ECS on Fargate and EC2.
• Can break clients: Automated agent configuration adds a GuardDuty VPC endpoint and security group to monitored VPCs, which blocks IaC deleting those subnets before Terraform AWS provider 6.43.0.

In the console

GuardDuty → Protection plans → Runtime Monitoring → Configuration

Runtime Monitoring

Enable

Automated agent configuration

Enable, so GuardDuty deploys and updates the agent on every EKS cluster; this check passes without it

With the AWS CLI

aws guardduty update-detector --detector-id <detector-id> --region <region> --features '[{"Name":"RUNTIME_MONITORING","Status":"ENABLED","AdditionalConfiguration":[{"Name":"EKS_ADDON_MANAGEMENT","Status":"ENABLED"}]}]'

With Terraform

resource "aws_guardduty_detector_feature" "this" {
  detector_id = aws_guardduty_detector.this.id
  name        = "RUNTIME_MONITORING"
  status      = "ENABLED"

  additional_configuration {
    name   = "EKS_ADDON_MANAGEMENT"
    status = "ENABLED"
  }
}