GuardDuty detector has S3 Protection enabled

Check ID: guardduty_s3_protection_enabled
Provider: AWS
Service: guardduty
Severity: HIGH
Resource type: AwsGuardDutyDetector

What this check verifies

Amazon GuardDuty detectors are evaluated for S3 Protection, which analyzes CloudTrail S3 data events to monitor object-level API activity (GetObject, PutObject, DeleteObject) across S3 buckets in the account and Region.

Risk

Without S3 Protection, object-level S3 activity isn’t analyzed, enabling:

Exfiltration via mass reads/copies
Destructive deletes
Policy/ACL tampering

Undetected actions degrade data confidentiality, integrity, and availability.

Recommendation

Enable S3 Protection across all accounts and Regions to add defense in depth for S3. Apply least privilege to IAM and bucket policies, keep Block Public Access enforced, integrate findings with alerting, and regularly review anomalies to prevent data loss and tampering.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws guardduty update-detector --detector-id <detector-id> --data-sources S3Logs={Enable=true}

# Enable S3 Protection on a GuardDuty detector
resource "aws_guardduty_detector" "<example_resource_name>" {
  enable = true

  datasources {
    s3_logs {
      enable = true  # Critical: Enables GuardDuty S3 Protection
    }
  }
}

# CloudFormation: Enable S3 Protection on a GuardDuty detector
Resources:
  <example_resource_name>:
    Type: AWS::GuardDuty::Detector
    Properties:
      Enable: true
      DataSources:
        S3Logs:
          Enable: true  # Critical: Enables GuardDuty S3 Protection

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = guardduty_s3_protection_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

GuardDuty detector has RDS Protection enabled IAM members with AdministratorAccess have MFA enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires