GuardDuty Lambda Protection should be enabled

How to fix it

Have the failing Region's GuardDuty detector carry the LAMBDA_NETWORK_LOGS feature with status ENABLED. The check also fails when the detector itself is not enabled, whatever the feature says, so GuardDuty has to be running in that Region first. GuardDuty then reads the network activity logs that Lambda invocations produce in the Region and bills on their volume.

In the console

GuardDuty → Protection plans → Lambda Protection

With the AWS CLI

aws guardduty update-detector --detector-id <detector-id> --region <region> --features '[{"Name":"LAMBDA_NETWORK_LOGS","Status":"ENABLED"}]'

With Terraform

resource "aws_guardduty_detector_feature" "this" {
  detector_id = aws_guardduty_detector.this.id
  name        = "LAMBDA_NETWORK_LOGS"
  status      = "ENABLED"
}