GuardDuty S3 Protection should be enabled

How to fix it

Have the failing Region's GuardDuty detector carry the S3_DATA_EVENTS feature with status ENABLED. The check also fails when the detector itself is not enabled, whatever the feature says, so GuardDuty has to be running in that Region first. GuardDuty pulls the S3 data events itself, with no CloudTrail trail to configure, and bills on their volume, which a single busy bucket can drive hard.

In the console

GuardDuty → Protection plans → S3 Protection

With the AWS CLI

aws guardduty update-detector --detector-id <detector-id> --region <region> --features '[{"Name":"S3_DATA_EVENTS","Status":"ENABLED"}]'

With Terraform

resource "aws_guardduty_detector_feature" "this" {
  detector_id = aws_guardduty_detector.this.id
  name        = "S3_DATA_EVENTS"
  status      = "ENABLED"
}