Back to Checks
aws

GuardDuty detector is enabled and not suspended

guardduty_is_enabled
Service: guarddutySeverity: high
OfficialBuilt-inVerified
Categories:forensics-ready
Resource Type:AwsGuardDutyDetector

Amazon GuardDuty detector existence and health are evaluated per Region. It identifies where GuardDuty isn't enabled for the account, where a detector has no status, or where a detector is configured but suspended.

Prowler logoProwlerprowler-provider-aws

Risk

Without active GuardDuty, threats in CloudTrail, VPC Flow Logs, DNS, S3, EKS, EBS, and Lambda can go unnoticed. Attackers can exfiltrate data, move laterally, and mine crypto, degrading confidentiality, integrity, and availability-especially in unmonitored Regions.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks guardduty_is_enabled

Recommendation

Enable and keep GuardDuty active in all supported Regions and accounts under a delegated admin. Turn on relevant protection plans and auto-enroll new accounts. Avoid suspended detectors, enforce least privilege for admins, and integrate findings into response for defense in depth.

Remediation

Terraform

# Terraform: Ensure GuardDuty detector is enabled (not suspended) in the Region
resource "aws_guardduty_detector" "example_resource_name" {
  enable = true  # Critical: turns GuardDuty on and ensures it is not suspended
}

NativeIaC

# CloudFormation: Ensure GuardDuty detector is enabled (not suspended) in the Region
Resources:
  ExampleGuardDutyDetector:
    Type: AWS::GuardDuty::Detector
    Properties:
      Enable: true  # Critical: enables the detector so GuardDuty is active (not suspended)

Other

1Sign in to the AWS Console and open Amazon GuardDuty
2Switch to the target AWS Region
3If prompted with Get started, click Enable GuardDuty
4If GuardDuty is already configured but suspended, go to Settings and click Enable (or Resume) to activate the detector
5Repeat in each required Region

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.guardduty.guardduty_client import guardduty_client


class guardduty_is_enabled(Check):
    def execute(self):
        findings = []
        for detector in guardduty_client.detectors:
            report = Check_Report_AWS(metadata=self.metadata(), resource=detector)
            report.status = "PASS"
            report.status_extended = f"GuardDuty detector {detector.id} enabled."

            if not detector.enabled_in_account:
                report.status = "FAIL"
                report.status_extended = "GuardDuty is not enabled."
            elif detector.status is None:
                report.status = "FAIL"
                report.status_extended = (
                    f"GuardDuty detector {detector.id} not configured."
                )
            elif not detector.status:
                report.status = "FAIL"
                report.status_extended = (
                    f"GuardDuty detector {detector.id} configured but suspended."
                )

            if report.status == "FAIL" and (
                guardduty_client.audit_config.get("mute_non_default_regions", False)
                and not detector.region == guardduty_client.region
            ):
                report.muted = True

            findings.append(report)

        return findings

References