Back to Checks
aws

GuardDuty detector has S3 Protection enabled

guardduty_s3_protection_enabled
Service: guarddutySeverity: high
OfficialBuilt-inVerified
Resource Type:AwsGuardDutyDetector

Amazon GuardDuty detectors are evaluated for S3 Protection, which analyzes CloudTrail S3 data events to monitor object-level API activity (GetObject, PutObject, DeleteObject) across S3 buckets in the account and Region.

Prowler logoProwlerprowler-provider-aws

Risk

Without S3 Protection, object-level S3 activity isn't analyzed, enabling:

  • Exfiltration via mass reads/copies
  • Destructive deletes
  • Policy/ACL tampering

Undetected actions degrade data confidentiality, integrity, and availability.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks guardduty_s3_protection_enabled

Recommendation

Enable S3 Protection across all accounts and Regions to add defense in depth for S3. Apply least privilege to IAM and bucket policies, keep Block Public Access enforced, integrate findings with alerting, and regularly review anomalies to prevent data loss and tampering.

Remediation

CLI

aws guardduty update-detector --detector-id <detector-id> --data-sources S3Logs={Enable=true}

Terraform

# Enable S3 Protection on a GuardDuty detector
resource "aws_guardduty_detector" "<example_resource_name>" {
  enable = true

  datasources {
    s3_logs {
      enable = true  # Critical: Enables GuardDuty S3 Protection
    }
  }
}

NativeIaC

# CloudFormation: Enable S3 Protection on a GuardDuty detector
Resources:
  <example_resource_name>:
    Type: AWS::GuardDuty::Detector
    Properties:
      Enable: true
      DataSources:
        S3Logs:
          Enable: true  # Critical: Enables GuardDuty S3 Protection

Other

1Open the AWS Management Console and go to GuardDuty
2In the left menu, select Settings
3Find the S3 Protection section and click Enable (or toggle On)
4Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.guardduty.guardduty_client import guardduty_client


class guardduty_s3_protection_enabled(Check):
    def execute(self):
        findings = []
        for detector in guardduty_client.detectors:
            if detector.status:
                report = Check_Report_AWS(metadata=self.metadata(), resource=detector)
                report.status = "FAIL"
                report.status_extended = (
                    "GuardDuty detector does not have S3 Protection enabled."
                )
                if detector.s3_protection:
                    report.status = "PASS"
                    report.status_extended = (
                        "GuardDuty detector has S3 Protection enabled."
                    )
                findings.append(report)
        return findings

References