All checks
High
GuardDuty S3 Protection should be enabled
Checks that GuardDuty S3 Protection is enabled on this Region's detector, so GuardDuty analyses object-level S3 data events on every bucket in this Region for risks such as data exfiltration and destruction. It also fails while GuardDuty is suspended in the Region. In an AWS Organization, only the GuardDuty delegated administrator can change this for a member account.
- service
- GuardDuty
- severity
- High
- scope
- evaluated in every region
How to fix it
In the console
GuardDuty → Protection plans → S3 Protection
- S3 Protection
- Enable; GuardDuty reads the S3 data events itself, so no CloudTrail trail or data event logging is needed
With the AWS CLI
aws guardduty update-detector --detector-id <detector-id> --region <region> --features '[{"Name":"S3_DATA_EVENTS","Status":"ENABLED"}]'With Terraform
resource "aws_guardduty_detector_feature" "this" {
detector_id = aws_guardduty_detector.this.id
name = "S3_DATA_EVENTS"
status = "ENABLED"
}See which of your accounts this check is failing on.
Book a live scan