🛡️ AWS GuardDuty Detector Malware Protection for EC2 is not enabled🟢

• Contextual name: 🛡️ Detector Malware Protection for EC2 is not enabled🟢
• ID: /ce/ca/aws/guardduty/detector-malware-protection-for-ec2
• Tags:
  • 🟢 Policy with categories
  • 🟢 Policy with type
  • 🟢 Production policy
• Policy Type: COMPLIANCE_POLICY
• Policy Categories: SECURITY

Logic

• 🧠 prod.logic.yaml🟢
  • 📗 AWS GuardDuty Detector
  • 🔌 AWS GuardDuty Detector - object.extracts.yaml
  • 🧪 test-data.json

Similar Policies

• AWS Security Hub: [GuardDuty.8] GuardDuty Malware Protection for EC2 should be enabled

Description

Open File

Description

This policy identifies AWS GuardDuty Detectors that do not have Malware Protection for EC2 enabled.

Malware Protection for EC2 helps detect potential malware by scanning Amazon EBS volumes attached to EC2 instances and container workloads running on Amazon EC2.

Rationale

GuardDuty Malware Protection for EC2 scans your EC2 instances for malware. When suspicious behavior is detected, GuardDuty can automatically initiate a malware scan of attached EBS volumes by taking a snapshot and analyzing it. This provides effective threat detection without requiring you to deploy or maintain additional security software on your instances.

Impact

Charges for GuardDuty Malware Protection are based on the total and prorated GB of Amazon EBS data scanned each month.

Audit

This policy flags an AWS GuardDuty Detector as INCOMPLIANT if the EBS_MALWARE_PROTECTION Feature is set to DISABLED.

Remediation

Open File

Remediation

Enable Malware Protection for EC2

Prerequisites

If the GuardDuty delegated administrator account is not the same as the management account in your organization, the management account must enable GuardDuty-initiated malware scans for the organization. This ensures that the delegated administrator account can create the Service-Linked Role permissions for Malware Protection for EC2 in member accounts managed through AWS Organizations.

1. Using your management account credentials, enable service access for Malware Protection:

   aws organizations enable-aws-service-access --service-principal malware-protection.guardduty.amazonaws.com

2. (Optional) To enable GuardDuty-initiated malware scans for the management account that is not a delegated administrator account:

   • Create the Service-Linked Role permissions for Malware Protection for EC2 in the management account:

     aws iam create-service-linked-role --aws-service-name malware-protection.guardduty.amazonaws.com

... see more

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags	Compliance
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [GuardDuty.8] GuardDuty Malware Protection for EC2 should be enabled			1		no data
💼 Cloudaware Framework → 💼 Threat Protection			36		no data