GuardDuty EKS Runtime Monitoring should be enabled

How to fix it

Have the failing Region's GuardDuty detector run runtime monitoring for EKS, through either the RUNTIME_MONITORING feature, the successor AWS recommends, or the older EKS_RUNTIME_MONITORING; a detector takes one or the other and errors on both. With EKS_ADDON_MANAGEMENT ENABLED GuardDuty deploys and updates the security agent on every EKS cluster in the Region; with it DISABLED the agent is yours to install, and this check cannot tell whether you have.

In the console

GuardDuty → Protection plans → Runtime Monitoring

With the AWS CLI

aws guardduty update-detector --detector-id <detector-id> --region <region> --features '[{"Name":"EKS_RUNTIME_MONITORING","Status":"ENABLED","AdditionalConfiguration":[{"Name":"EKS_ADDON_MANAGEMENT","Status":"ENABLED"}]}]'

With Terraform

resource "aws_guardduty_detector_feature" "this" {
  detector_id = aws_guardduty_detector.this.id
  name        = "EKS_RUNTIME_MONITORING"
  status      = "ENABLED"

  additional_configuration {
    name   = "EKS_ADDON_MANAGEMENT"
    status = "ENABLED"
  }
}