All checks
High
GuardDuty should be enabled
Confirms that Amazon GuardDuty is enabled in each Region, so unusual or unauthorized activity is detected even in Regions you do not use. A finding on a Region means it has no detector; a finding on a detector means it is suspended, and is re-enabled with update-detector --enable, since create-detector fails once a detector exists.
- service
- GuardDuty
- severity
- High
- scope
- evaluated in every region
How to fix it
In the console
GuardDuty → Get started for a Region with no detector, or GuardDuty → Settings → Re-enable GuardDuty for a suspended one
With the AWS CLI
aws guardduty create-detector --enable --region <region>With Terraform
resource "aws_guardduty_detector" "this" {
enable = true
}See which of your accounts this check is failing on.
Book a demo