GuardDuty EKS Runtime Monitoring should be enabled

Description

This control checks whether GuardDuty EKS Runtime Monitoring with automated agent management is enabled. For a standalone account, the control fails if GuardDuty EKS Runtime Monitoring with automated agent management is disabled. In a multi-account environment, the control fails if the delegated GuardDuty administrator account and all member accounts do not have EKS Runtime Monitoring with automated agent management enabled. EKS Protection in Amazon GuardDuty provides threat detection coverage to help you protect Amazon EKS clusters within your AWS environment. EKS Runtime Monitoring uses operating system-level events to help you detect potential threats in EKS nodes and containers within your EKS clusters.

---

Remediation

To enable GuardDuty EKS Runtime Monitoring, you need to configure the EKS Runtime Monitoring settings in GuardDuty.

Steps