All checks
High
GuardDuty Lambda Protection should be enabled
Checks that GuardDuty Lambda Protection is enabled on this Region's detector, so GuardDuty monitors the network activity of every Lambda function invoked here, VPC-connected or not, for signs of malicious code. It also fails while GuardDuty is suspended in the Region. In an AWS Organization, only the GuardDuty delegated administrator can change this for a member account.
- service
- GuardDuty
- severity
- High
- scope
- evaluated in every region
How to fix it
In the console
GuardDuty → Protection plans → Lambda Protection
- Lambda Protection
- Enable; no VPC flow logs need to be turned on for the functions
With the AWS CLI
aws guardduty update-detector --detector-id <detector-id> --region <region> --features '[{"Name":"LAMBDA_NETWORK_LOGS","Status":"ENABLED"}]'With Terraform
resource "aws_guardduty_detector_feature" "this" {
detector_id = aws_guardduty_detector.this.id
name = "LAMBDA_NETWORK_LOGS"
status = "ENABLED"
}See which of your accounts this check is failing on.
Book a live scan