Check ID: guardduty_is_enabled
Provider: AWS
Service: guardduty
Severity: HIGH
Categories: forensics-ready
Resource type: AwsGuardDutyDetector

​
What this check verifies

Amazon GuardDuty detector existence and health are evaluated per Region. It identifies where GuardDuty isn’t enabled for the account, where a detector has no status, or where a detector is configured but suspended.

​
Risk

Without active GuardDuty, threats in CloudTrail, VPC Flow Logs, DNS, S3, EKS, EBS, and Lambda can go unnoticed. Attackers can exfiltrate data, move laterally, and mine crypto, degrading confidentiality, integrity, and availability-especially in unmonitored Regions.

​
Recommendation

Enable and keep GuardDuty active in all supported Regions and accounts under a delegated admin. Turn on relevant protection plans and auto-enroll new accounts. Avoid suspended detectors, enforce least privilege for admins, and integrate findings into response for defense in depth.

​
Remediation

# Terraform: Ensure GuardDuty detector is enabled (not suspended) in the Region
resource "aws_guardduty_detector" "example_resource_name" {
  enable = true  # Critical: turns GuardDuty on and ensures it is not suspended
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = guardduty_is_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks