All checks
High
GuardDuty Malware Protection for EC2 should be enabled
Checks that GuardDuty Malware Protection for EC2 is enabled on this Region's detector, so GuardDuty scans the EBS volumes of EC2 instances and container workloads it suspects. Scans start only from GuardDuty findings, so a quiet account may run none. It also fails while GuardDuty is suspended. In an AWS Organization, only the GuardDuty delegated administrator can change this for a member account.
- service
- GuardDuty
- severity
- High
- scope
- evaluated in every region
How to fix it
In the console
GuardDuty → Protection plans → Malware Protection for EC2
- GuardDuty-initiated malware scan
- Enable
With the AWS CLI
aws guardduty update-detector --detector-id <detector-id> --region <region> --features '[{"Name":"EBS_MALWARE_PROTECTION","Status":"ENABLED"}]'With Terraform
resource "aws_guardduty_detector_feature" "this" {
detector_id = aws_guardduty_detector.this.id
name = "EBS_MALWARE_PROTECTION"
status = "ENABLED"
}See which of your accounts this check is failing on.
Book a live scan