Back to Checks
aws

GuardDuty detector has EKS Runtime Monitoring enabled

guardduty_eks_runtime_monitoring_enabled
Service: guarddutySeverity: medium
OfficialBuilt-inVerified
Resource Type:AwsGuardDutyDetector

GuardDuty detectors are evaluated for EKS Runtime Monitoring being enabled for Amazon EKS. The configuration is at the detector level and relates to visibility into process, file, and network activity on EKS nodes and containers.

Prowler logoProwlerprowler-provider-aws

Risk

Absent EKS runtime monitoring, in-cluster activity is blind to detection. Adversaries can run malware or cryptominers, exfiltrate secrets via pods, tamper with workloads, or pivot to other services, degrading confidentiality, corrupting integrity, and exhausting resources (availability).

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks guardduty_eks_runtime_monitoring_enabled

Recommendation

  • Enable EKS Runtime Monitoring with automated agent management across all accounts and clusters
  • Enforce least privilege for agents and segment cluster access
  • Integrate findings with response workflows and periodically verify runtime coverage

Remediation

CLI

aws guardduty update-detector --detector-id <detector-id> --features Name=EKS_RUNTIME_MONITORING,Status=ENABLED

Terraform

resource "aws_guardduty_detector" "<example_resource_name>" {
  enable = true
}

resource "aws_guardduty_detector_feature" "<example_resource_name>" {
  detector_id = aws_guardduty_detector.<example_resource_name>.id
  name        = "EKS_RUNTIME_MONITORING"  # Critical: selects EKS Runtime Monitoring
  status      = "ENABLED"                 # Critical: enables the feature

  additional_configuration {
    name   = "EKS_ADDON_MANAGEMENT"
    status = "ENABLED"
  }
}

NativeIaC

Resources:
  <example_resource_name>:
    Type: AWS::GuardDuty::Detector
    Properties:
      Enable: true
      Features:
        - Name: EKS_RUNTIME_MONITORING   # Critical: selects EKS Runtime Monitoring feature
          Status: ENABLED                # Critical: enables the feature to pass the check

Other

1Open the AWS Console and go to Amazon GuardDuty
2In the left pane, select Settings > Runtime monitoring
3Under EKS Runtime Monitoring, switch the status to Enabled
4Click Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.guardduty.guardduty_client import guardduty_client


class guardduty_eks_runtime_monitoring_enabled(Check):
    def execute(self):
        findings = []
        for detector in guardduty_client.detectors:
            if detector.status:
                report = Check_Report_AWS(metadata=self.metadata(), resource=detector)
                report.status = "FAIL"
                report.status_extended = f"GuardDuty detector {detector.id} does not have EKS Runtime Monitoring enabled."
                if detector.eks_runtime_monitoring:
                    report.status = "PASS"
                    report.status_extended = f"GuardDuty detector {detector.id} has EKS Runtime Monitoring enabled."
                findings.append(report)
        return findings

References