GuardDuty RDS Protection should be enabled

Checks that GuardDuty RDS Protection is enabled on this Region's detector, so GuardDuty profiles login activity on supported Aurora, RDS for PostgreSQL, RDS for MySQL and RDS for MariaDB databases to detect access threats. It also fails while GuardDuty is suspended in the Region. In an AWS Organization, only the GuardDuty delegated administrator can change this for a member account.

service: GuardDuty
severity: High
scope: evaluated in every region

How to fix it

In the console

GuardDuty → Protection plans → RDS Protection

RDS Protection: Enable

With the AWS CLI

aws guardduty update-detector --detector-id <detector-id> --region <region> --features '[{"Name":"RDS_LOGIN_EVENTS","Status":"ENABLED"}]'

With Terraform

resource "aws_guardduty_detector_feature" "this" {
  detector_id = aws_guardduty_detector.this.id
  name        = "RDS_LOGIN_EVENTS"
  status      = "ENABLED"
}

See which of your accounts this check is failing on.

Book a live scan

GuardDuty RDS Protection should be enabled

How to fix it

In the console

With the AWS CLI

With Terraform

More GuardDuty checks