GuardDuty Malware Protection for EC2 should be enabled

How to fix it

Have the failing Region's GuardDuty detector carry the EBS_MALWARE_PROTECTION feature with status ENABLED. The check also fails when the detector itself is not enabled, whatever the feature says, so GuardDuty has to be running in that Region first. Scans are started by GuardDuty findings rather than on a schedule, so a quiet account may run none, and GuardDuty bills the EBS data each scan it does start has to read.

In the console

GuardDuty → Protection plans → Malware Protection for EC2

With the AWS CLI

aws guardduty update-detector --detector-id <detector-id> --region <region> --features '[{"Name":"EBS_MALWARE_PROTECTION","Status":"ENABLED"}]'

With Terraform

resource "aws_guardduty_detector_feature" "this" {
  detector_id = aws_guardduty_detector.this.id
  name        = "EBS_MALWARE_PROTECTION"
  status      = "ENABLED"
}