GuardDuty Runtime Monitoring should be enabled

How to fix it

Have the failing Region's GuardDuty detector carry the RUNTIME_MONITORING feature with status ENABLED, and GuardDuty running there. The feature alone leaves the security agent unmanaged and no runtime events arrive until it is deployed, through this feature's agent management setting or by hand. A detector takes RUNTIME_MONITORING or the older EKS_RUNTIME_MONITORING but not both, so a Region on the older one must disable it in the same update-detector call or the command shown is rejected.

In the console

GuardDuty → Protection plans → Runtime Monitoring → Configuration

With the AWS CLI

aws guardduty update-detector --detector-id <detector-id> --region <region> --features '[{"Name":"RUNTIME_MONITORING","Status":"ENABLED"}]'

With Terraform

resource "aws_guardduty_detector_feature" "this" {
  detector_id = aws_guardduty_detector.this.id
  name        = "RUNTIME_MONITORING"
  status      = "ENABLED"
}