GuardDuty Runtime Monitoring should be enabled

How to fix it

• Affects another check: This also passes GuardDuty.7, but GuardDuty.12 and GuardDuty.13 keep failing until automated agent configuration is on for ECS on Fargate and EC2.
• Can break clients: Automated agent configuration adds a GuardDuty VPC endpoint and security group to monitored VPCs, which blocks IaC deleting those subnets before Terraform AWS provider 6.43.0.

In the console

GuardDuty → Protection plans → Runtime Monitoring → Configuration

Runtime Monitoring

Enable

Automated agent configuration

Enable for each resource type you run; this check passes without it, but no events arrive until an agent runs

With the AWS CLI

aws guardduty update-detector --detector-id <detector-id> --region <region> --features '[{"Name":"RUNTIME_MONITORING","Status":"ENABLED"}]'

With Terraform

resource "aws_guardduty_detector_feature" "this" {
  detector_id = aws_guardduty_detector.this.id
  name        = "RUNTIME_MONITORING"
  status      = "ENABLED"
}