GuardDuty detector has EKS Runtime Monitoring enabled

Check ID: guardduty_eks_runtime_monitoring_enabled
Provider: AWS
Service: guardduty
Severity: MEDIUM
Resource type: AwsGuardDutyDetector

What this check verifies

GuardDuty detectors are evaluated for EKS Runtime Monitoring being enabled for Amazon EKS. The configuration is at the detector level and relates to visibility into process, file, and network activity on EKS nodes and containers.

Risk

Absent EKS runtime monitoring, in-cluster activity is blind to detection. Adversaries can run malware or cryptominers, exfiltrate secrets via pods, tamper with workloads, or pivot to other services, degrading confidentiality, corrupting integrity, and exhausting resources (availability).

Recommendation

Enable EKS Runtime Monitoring with automated agent management across all accounts and clusters
Enforce least privilege for agents and segment cluster access
Integrate findings with response workflows and periodically verify runtime coverage

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws guardduty update-detector --detector-id <detector-id> --features name=EKS_RUNTIME_MONITORING,status=ENABLED

resource "aws_guardduty_detector" "<example_resource_name>" {
  enable = true

  features {
    name   = "EKS_RUNTIME_MONITORING"  # Critical: selects EKS Runtime Monitoring feature
    status = "ENABLED"                 # Critical: enables the feature to pass the check
  }
}

Resources:
  <example_resource_name>:
    Type: AWS::GuardDuty::Detector
    Properties:
      Enable: true
      Features:
        - Name: EKS_RUNTIME_MONITORING   # Critical: selects EKS Runtime Monitoring feature
          Status: ENABLED                # Critical: enables the feature to pass the check

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = guardduty_eks_runtime_monitoring_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

GuardDuty detector has EKS Audit Log Monitoring enabled GuardDuty detector is enabled and not suspended

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires