Check provider logo

GuardDuty detector has Lambda Protection enabled

guardduty_lambda_protection_enabled

Severityhigh
Serviceguardduty
by Prowler

Amazon GuardDuty detectors with Lambda Protection enabled analyze Lambda invocation network activity logs across your account.

Evaluation determines whether the detector has Lambda Protection turned on.

Risk

Without Lambda Protection, Lambda network traffic is uninspected, enabling:

  • C2 callbacks and data exfiltration (confidentiality)
  • Malicious code altering data or configs (integrity)
  • Lateral movement or abuse causing disruption (availability)
Run this check with Prowler CLI

prowler aws --checks guardduty_lambda_protection_enabled

Run in Prowler Cloud

Recommendation

Enable Lambda Protection on all detectors in every active Region and account.

Apply least privilege to Lambda roles, restrict egress with network controls, and integrate findings with alerting and response for defense in depth. In multi-account setups, manage centrally for consistent coverage.

Remediation

CLI

aws guardduty update-detector --detector-id <detector-id> --features '[{"Name":"LAMBDA_NETWORK_LOGS","Status":"ENABLED"}]'

Native IaC
Terraform
Other
  1. Open the AWS Console and go to GuardDuty
  2. In the left pane, select Settings > Lambda Protection
  3. Click Enable
  4. Click Confirm to save

Source Code

Resource Type

AwsGuardDutyDetector

References