Back to Checks
aws

GuardDuty detector has AI Protection enabled

guardduty_ai_protection_enabled
Service: guarddutySeverity: high
OfficialBuilt-inVerified
Resource Type:AwsGuardDutyDetector

Active Amazon GuardDuty detectors are assessed for AI Protection being enabled, which analyzes AWS CloudTrail data events from Amazon Bedrock, Amazon Bedrock AgentCore and Amazon SageMaker AI to flag anomalous model invocations, cost harvesting and prompt injection. Detectors that do not report the feature return MANUAL, because absence means the Region does not offer it.

Prowler logoProwlerprowler-provider-aws

Risk

Without AI Protection, model invocation activity is never baselined, so attackers using stolen credentials can invoke foundation models undetected.

That costs confidentiality of prompts and outputs, and availability too: expensive prompts harvest inference spend and exhaust quota.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks guardduty_ai_protection_enabled

Recommendation

Enable GuardDuty AI Protection in every account and Region hosting AI workloads.

  • Enable it org-wide from the delegated GuardDuty administrator and auto-enable it for new accounts
  • Enforce Amazon Bedrock Guardrails for prompt attacks, which AI Protection requires to raise prompt injection findings
  • Route findings to AWS Security Hub and review them on a defined cadence

Remediation

CLI

aws guardduty update-detector --detector-id <detector-id> --features Name=AI_PROTECTION,Status=ENABLED

Terraform

resource "aws_guardduty_detector_feature" "<example_resource_name>" {
  detector_id = aws_guardduty_detector.<example_detector_name>.id
  name        = "AI_PROTECTION"  # Critical: GuardDuty AI Protection plan
  status      = "ENABLED"        # Critical: enable the feature
}

NativeIaC

Resources:
  <example_resource_name>:
    Type: AWS::GuardDuty::Detector
    Properties:
      Enable: true
      Features:
        - Name: AI_PROTECTION  # Critical: selects the GuardDuty AI Protection plan
          Status: ENABLED      # Critical: turns AI Protection on

Other

1Open the AWS Console and go to Amazon GuardDuty
2In the Region selector, choose a Region that offers AI Protection
3In the navigation pane, choose Protection plans
4Choose Configure all enablements, then under AI Protection choose Enable
5Choose Save all, then Confirm and save
6In an organization, do this from the delegated GuardDuty administrator account and auto-enable it for new accounts

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.guardduty.guardduty_client import guardduty_client


class guardduty_ai_protection_enabled(Check):
    """Ensure GuardDuty AI Protection is enabled on every active detector.

    AI Protection analyzes AWS CloudTrail data events from Amazon Bedrock, Amazon
    Bedrock AgentCore and Amazon SageMaker AI, which makes it the detective control
    for AI workloads.

    The feature has three observable states rather than two:

    1. Reported as ENABLED: PASS.
    2. Reported as DISABLED: FAIL.
    3. Not reported at all: MANUAL. GuardDuty omits features that the Region or the
       GuardDuty version does not offer, and "could not tell" is not "not
       compliant". The same account can carry a feature in some Regions and omit it
       in others, so absence cannot be read as disablement.

    A suspended detector, or one whose GetDetector call failed, is MANUAL as well:
    the feature state is unknown either way, and guardduty_is_enabled owns the
    detector-level finding. Regions with no detector at all are left to
    guardduty_is_enabled entirely.
    """

    def execute(self) -> list[Check_Report_AWS]:
        """Assess AI Protection on every GuardDuty detector in the account.

        Returns:
            list[Check_Report_AWS]: one report per detector that exists. PASS when AI
                Protection is enabled, FAIL when GuardDuty reported the feature
                disabled, and MANUAL when either the detector state or the feature
                itself was not reported.
        """
        findings = []
        for detector in guardduty_client.detectors:
            if not detector.enabled_in_account:
                continue

            report = Check_Report_AWS(metadata=self.metadata(), resource=detector)

            if not detector.status:
                report.status = "MANUAL"
                report.status_extended = f"GuardDuty detector {detector.id} is not enabled or could not be read, so AI Protection coverage could not be determined."
            elif detector.ai_protection is None:
                report.status = "MANUAL"
                report.status_extended = f"GuardDuty detector {detector.id} does not report the AI Protection feature, so verify manually whether AI Protection is available in region {detector.region}."
            elif detector.ai_protection:
                report.status = "PASS"
                report.status_extended = (
                    f"GuardDuty detector {detector.id} has AI Protection enabled."
                )
            else:
                report.status = "FAIL"
                report.status_extended = f"GuardDuty detector {detector.id} does not have AI Protection enabled."

            findings.append(report)
        return findings

References