# Whether malware scanning is switched on for compute and for the buckets that accept uploads, plus the scan-by-scan record of what was actually examined and what came back INFECTED

> FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14
> Canonical page: /collect/malicious-code-protection

Recipe id: `malicious-code-protection` · cadence weekly · partial

> **Authored opinion.** AWS overlay v3.0.0, written
> against dataset 2026.07.14.01. The upstream
> FedRAMP rules name none of these tools; this mapping is ours.

## What it proves

- KSI `KSI-CNA-DFP`
- KSI `KSI-CMT-RMV`
- control `si-3`

## Collection

Kind: `cli`

```sh
# list-detectors
aws guardduty list-detectors
# get-detector
aws guardduty get-detector --detector-id <DETECTOR_ID> --query '{status:Status,publishingFrequency:FindingPublishingFrequency,features:Features[].{name:Name,status:Status,additional:AdditionalConfiguration}}'
# describe-malware-scans
aws guardduty describe-malware-scans --detector-id <DETECTOR_ID> --query 'Scans[].{id:ScanId,type:ScanType,status:ScanStatus,result:ScanResultDetails,started:ScanStartTime,ended:ScanEndTime,files:FileCount,bytes:TotalBytes,resource:ResourceDetails,trigger:TriggerDetails,failure:FailureReason}'
# list-malware-protection-plans
aws guardduty list-malware-protection-plans
# get-malware-protection-plan
aws guardduty get-malware-protection-plan --malware-protection-plan-id <PLAN_ID> --query '{protected:ProtectedResource,status:Status,statusReasons:StatusReasons,actions:Actions,role:Role,created:CreatedAt}'
# guardduty-malware-protection-enabled
aws configservice get-compliance-details-by-config-rule --config-rule-name guardduty-malware-protection-enabled --compliance-types NON_COMPLIANT
```

## Expected output

A detector id per Region — an empty list means GuardDuty was never enabled there, which is itself the finding. Then the detector's Status ENABLED or DISABLED, its FindingPublishingFrequency of FIFTEEN_MINUTES, ONE_HOUR or SIX_HOURS, and the Features list in which EBS_MALWARE_PROTECTION is the entry that matters, alongside FLOW_LOGS, CLOUD_TRAIL, DNS_LOGS, S3_DATA_EVENTS, EKS_AUDIT_LOGS, RDS_LOGIN_EVENTS, LAMBDA_NETWORK_LOGS, EKS_RUNTIME_MONITORING and RUNTIME_MONITORING with its EC2_AGENT_MANAGEMENT, EKS_ADDON_MANAGEMENT and ECS_FARGATE_AGENT_MANAGEMENT sub-configuration. Then one row per malware scan: ScanId, ScanType GUARDDUTY_INITIATED or ON_DEMAND, ScanStatus RUNNING, COMPLETED, FAILED or SKIPPED, a FailureReason when it failed, ScanStartTime and ScanEndTime, the scanned InstanceArn and its attached volumes, FileCount and TotalBytes actually examined, TriggerDetails carrying the GuardDutyFindingId and a TriggerType of GUARDDUTY or BACKUP, and a ScanResultDetails of CLEAN or INFECTED. Then the Malware Protection plan ids, and per plan the protected S3 bucket with its object prefixes, the scanning role, whether result tagging is on, and a Status of ACTIVE, WARNING or ERROR with StatusReasons naming the problem. Finally, outside GovCloud, the detectors AWS Config marks NON_COMPLIANT for GUARDDUTY_MALWARE_PROTECTION_ENABLED.

## Assertions

_No machine-checkable assertion is authored for this recipe._

## GovCloud

GuardDuty runs in both AWS GovCloud (US) Regions and Malware Protection for EC2 works there with one documented gap: instances whose productCode is marketplace are not scanned — GuardDuty skips them and logs the skip reason UNSUPPORTED_PRODUCT_CODE_TYPE, so a SKIPPED scan in GovCloud may be that rather than a misconfiguration. Malware Protection for Backup cannot scan EC2 or EBS recovery points there. The GovCloud differences page records no carve-out for Malware Protection for S3. The last command has nothing to call: GUARDDUTY_MALWARE_PROTECTION_ENABLED is excluded from both AWS GovCloud (US-East) and (US-West) — as it is from the China Regions, Mexico (Central), Asia Pacific (Thailand), (Malaysia) and (Taipei) — so drop it and take the enablement fact from the EBS_MALWARE_PROTECTION feature status in get-detector instead. Also unavailable in GovCloud: the entity lists customisation (IP address lists still work) and the GuardDuty Investigation preview. ARNs use partition arn:aws-us-gov

## Notes

The trap in SI-3 is reading GuardDuty Malware Protection as antivirus. It is not a scheduled sweep of your file systems. A GuardDuty-initiated scan fires only after GuardDuty has already produced a finding indicative of malware on that resource, at most once every 24 hours per resource, and it works agentlessly against snapshots of the attached EBS volumes — so an empty describe-malware-scans list is the expected steady state of a healthy estate and proves nothing about coverage. The two enablement reads prove capability; the scan list proves exercise; neither proves protection. Coverage has a second silent hole: the global GuardDutyExcluded:true tag and your own inclusion or exclusion scan-option tags make GuardDuty initiate a scan and then skip it, so read the scan options next to the tag inventory or a deliberately excluded estate looks like a clean one, and Fargate workloads under EKS or ECS are not scanned at all. Malware Protection for S3 is the closest thing here to SI-3's entry-point requirement — it scans each newly uploaded object and each new version in a configured bucket — but it covers only buckets with an active plan, in the same Region as the plan, in your own account (a delegated GuardDuty administrator cannot enable it on a member account's bucket), and when run independently of GuardDuty there is no detector, so malware produces an EventBridge event, a CloudWatch metric and the optional object tag rather than a GuardDuty finding. What no command here produces is the rest of SI-3: signature or engine currency, since AWS operates the scan engines and exposes no version for you to attest to; periodic full scans; false-positive handling; and the documented response when malicious code is found. Rate those from the plan and the incident record, and keep these reads as the machine half of the answer.

## References

- {"title":"Amazon GuardDuty: Malware Protection for EC2 (GuardDuty-initiated vs on-demand scans, Fargate unsupported)","url":"https://docs.aws.amazon.com/guardduty/latest/ug/malware-protection.html"}
- {"title":"Amazon GuardDuty: GuardDuty-initiated malware scan (fires only on a malware-indicative finding, 24-hour interval, GuardDutyExcluded tag)","url":"https://docs.aws.amazon.com/guardduty/latest/ug/gdu-initiated-malware-scan.html"}
- {"title":"Amazon GuardDuty: Malware Protection for S3 (scans newly uploaded objects; independent mode has no detector and so no finding)","url":"https://docs.aws.amazon.com/guardduty/latest/ug/gdu-malware-protection-s3.html"}
- {"title":"AWS CLI: guardduty get-detector (Features list including EBS_MALWARE_PROTECTION and its status)","url":"https://docs.aws.amazon.com/cli/latest/reference/guardduty/get-detector.html"}
- {"title":"AWS CLI: guardduty describe-malware-scans (ScanStatus, ScanType, TriggerDetails, ScanResultDetails, FileCount, TotalBytes)","url":"https://docs.aws.amazon.com/cli/latest/reference/guardduty/describe-malware-scans.html"}
- {"title":"AWS CLI: guardduty list-malware-protection-plans (plan ids for protected resources)","url":"https://docs.aws.amazon.com/cli/latest/reference/guardduty/list-malware-protection-plans.html"}
- {"title":"AWS CLI: guardduty get-malware-protection-plan (ProtectedResource, Status ACTIVE/WARNING/ERROR, StatusReasons)","url":"https://docs.aws.amazon.com/cli/latest/reference/guardduty/get-malware-protection-plan.html"}
- {"title":"AWS Config managed rule: guardduty-malware-protection-enabled (GUARDDUTY_MALWARE_PROTECTION_ENABLED, excluded from both AWS GovCloud (US) Regions)","url":"https://docs.aws.amazon.com/config/latest/developerguide/guardduty-malware-protection-enabled.html"}
- {"title":"Amazon GuardDuty in AWS GovCloud (US) — Malware Protection for EC2 marketplace productCode skip, Backup recovery point limits","url":"https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/govcloud-guardduty.html"}