GuardDuty detector has Lambda Protection enabled

Check ID: guardduty_lambda_protection_enabled
Provider: AWS
Service: guardduty
Severity: HIGH
Resource type: AwsGuardDutyDetector

What this check verifies

Amazon GuardDuty detectors with Lambda Protection enabled analyze Lambda invocation network activity logs across your account. Evaluation determines whether the detector has Lambda Protection turned on.

Risk

Without Lambda Protection, Lambda network traffic is uninspected, enabling:

C2 callbacks and data exfiltration (confidentiality)
Malicious code altering data or configs (integrity)
Lateral movement or abuse causing disruption (availability)

Recommendation

Enable Lambda Protection on all detectors in every active Region and account. Apply least privilege to Lambda roles, restrict egress with network controls, and integrate findings with alerting and response for defense in depth. In multi-account setups, manage centrally for consistent coverage.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws guardduty update-detector --detector-id <detector-id> --features '[{"Name":"LAMBDA_NETWORK_LOGS","Status":"ENABLED"}]'

resource "aws_guardduty_detector" "<example_resource_name>" {
  enable = true
  features {
    name   = "LAMBDA_NETWORK_LOGS"  # Critical: selects Lambda Protection feature
    status = "ENABLED"               # Critical: enables Lambda Protection
  }
}

Resources:
  <example_resource_name>:
    Type: AWS::GuardDuty::Detector
    Properties:
      Enable: true
      Features:
        - Name: LAMBDA_NETWORK_LOGS  # Critical: selects Lambda Protection feature
          Status: ENABLED            # Critical: enables Lambda Protection

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = guardduty_lambda_protection_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

GuardDuty detector is enabled and not suspended GuardDuty detector has no high severity findings

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires