GuardDuty RDS Protection should be enabled

How to fix it

Have the failing Region's GuardDuty detector carry the RDS_LOGIN_EVENTS feature with status ENABLED. The check also fails when the detector itself is not enabled, whatever the feature says, so GuardDuty has to be running in that Region first. GuardDuty then profiles login activity on the supported RDS and Aurora database engines in the Region and bills per provisioned vCPU, or per Aurora capacity unit on Serverless v2.

In the console

GuardDuty → Protection plans → RDS Protection

With the AWS CLI

aws guardduty update-detector --detector-id <detector-id> --region <region> --features '[{"Name":"RDS_LOGIN_EVENTS","Status":"ENABLED"}]'

With Terraform

resource "aws_guardduty_detector_feature" "this" {
  detector_id = aws_guardduty_detector.this.id
  name        = "RDS_LOGIN_EVENTS"
  status      = "ENABLED"
}