Back to Checks
aws

GuardDuty detector has Lambda Protection enabled

guardduty_lambda_protection_enabled
Service: guarddutySeverity: high
OfficialBuilt-inVerified
Resource Type:AwsGuardDutyDetector

Amazon GuardDuty detectors with Lambda Protection enabled analyze Lambda invocation network activity logs across your account.

Evaluation determines whether the detector has Lambda Protection turned on.

Prowler logoProwlerprowler-provider-aws

Risk

Without Lambda Protection, Lambda network traffic is uninspected, enabling:

  • C2 callbacks and data exfiltration (confidentiality)
  • Malicious code altering data or configs (integrity)
  • Lateral movement or abuse causing disruption (availability)

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks guardduty_lambda_protection_enabled

Recommendation

Enable Lambda Protection on all detectors in every active Region and account.

Apply least privilege to Lambda roles, restrict egress with network controls, and integrate findings with alerting and response for defense in depth. In multi-account setups, manage centrally for consistent coverage.

Remediation

CLI

aws guardduty update-detector --detector-id <detector-id> --features '[{"Name":"LAMBDA_NETWORK_LOGS","Status":"ENABLED"}]'

Terraform

resource "aws_guardduty_detector" "<example_resource_name>" {
  enable = true
  features {
    name   = "LAMBDA_NETWORK_LOGS"  # Critical: selects Lambda Protection feature
    status = "ENABLED"               # Critical: enables Lambda Protection
  }
}

NativeIaC

Resources:
  <example_resource_name>:
    Type: AWS::GuardDuty::Detector
    Properties:
      Enable: true
      Features:
        - Name: LAMBDA_NETWORK_LOGS  # Critical: selects Lambda Protection feature
          Status: ENABLED            # Critical: enables Lambda Protection

Other

1Open the AWS Console and go to GuardDuty
2In the left pane, select Settings > Lambda Protection
3Click Enable
4Click Confirm to save

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.guardduty.guardduty_client import guardduty_client


class guardduty_lambda_protection_enabled(Check):
    def execute(self):
        findings = []
        for detector in guardduty_client.detectors:
            if detector.status:
                report = Check_Report_AWS(metadata=self.metadata(), resource=detector)
                report.status = "FAIL"
                report.status_extended = f"GuardDuty detector {detector.id} does not have Lambda Protection enabled."
                if detector.lambda_protection:
                    report.status = "PASS"
                    report.status_extended = f"GuardDuty detector {detector.id} has Lambda Protection enabled."
                findings.append(report)
        return findings

References