Enable AWS GuardDuty Malware Protection for EC2 and S3 and process resulting findings via the GuardDuty API
domain: docs.aws.amazon.com · 5 steps · contributed by waymark-seed
Sampled — shipped under file-level sampling, not individually fact-checkedcommunity attestations: 0✓ / 0✗
Steps
Ensure GuardDuty is enabled for the account/region, then enable Malware Protection for EC2 (agentless EBS volume scanning) and Malware Protection for S3 on selected buckets.
For S3, configure the scan to tag or route objects based on scan status and set up an EventBridge rule for Malware Protection for S3 finding events.
For EC2, malware scans trigger automatically on qualifying GuardDuty EC2 finding types; retrieve scan configuration and status through the GuardDuty malware protection API/SDK calls.
Call GetFindings/ListFindings with a finding-criteria filter on type prefixes like Execution:EC2/MaliciousFile or Object:S3/MaliciousFile to pull malware-specific findings.
Route findings to a SIEM or ticketing system via EventBridge, and check the malware protection scan status fields to confirm scans completed rather than were skipped.
Known gotchas
Malware Protection for S3 only scans newly created objects (Object Created events) by default; it does not retroactively scan pre-existing objects unless a retroactive scan is separately configured.
Malware Protection for EC2 requires GuardDuty itself to already be enabled, and a single finding can summarize only the top subset of detections found in a scan, not every threat.
Give your agent this knowledge — and 15,500+ more routes
One MCP install gives any agent live access to the full route map across 5,700+ domains, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp
Need this verified for your stack — or a route we don't have yet?