GuardDuty detector has RDS Protection enabled

Check ID: guardduty_rds_protection_enabled
Provider: AWS
Service: guardduty
Severity: HIGH
Resource type: AwsGuardDutyDetector

What this check verifies

Active Amazon GuardDuty detectors are assessed for RDS Protection being enabled, allowing analysis of RDS and Aurora login activity to profile and flag anomalous access patterns.

Risk

Without RDS Protection, anomalous database logins can go unnoticed. Attackers using stolen or brute-forced credentials may access data, alter schemas, or pivot via the DB, impacting confidentiality and integrity, and potentially availability.

Recommendation

Enable GuardDuty RDS Protection across all accounts and Regions.

Enforce least privilege for DB users and rotate credentials
Restrict network exposure to databases
Integrate findings with alerting and incident response for rapid containment

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws guardduty update-detector --detector-id <detector-id> --features Name=RDS_LOGIN_EVENTS,Status=ENABLED

resource "aws_guardduty_detector" "<example_resource_name>" {
  enable = true
  features {
    name   = "RDS_LOGIN_EVENTS"  # critical: GuardDuty RDS Protection feature
    status = "ENABLED"            # critical: enable the feature
  }
}

Resources:
  <example_resource_name>:
    Type: AWS::GuardDuty::Detector
    Properties:
      Enable: true
      Features:
        - Name: RDS_LOGIN_EVENTS  # critical: selects GuardDuty RDS Protection feature
          Status: ENABLED         # critical: turns RDS Protection on

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = guardduty_rds_protection_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

GuardDuty detector has no high severity findings GuardDuty detector has S3 Protection enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires