Question

A security engineer at a fintech company runs several Amazon EKS clusters that host containerized payment workloads. Leadership wants Amazon GuardDuty to detect threats such as suspicious API calls to the Kubernetes control plane (e.g., anonymous access to sensitive resources) AND malicious process activity occurring inside running containers (e.g., a reverse shell spawned in a pod). The engineer has already enabled GuardDuty in the account. What must the engineer configure to satisfy BOTH detection requirements?

Accepted Answer

Enable EKS Protection (Kubernetes audit log monitoring) and EKS Runtime Monitoring with the automated GuardDuty security agent for the clusters

Answer

Enable only EKS Protection, which analyzes Kubernetes audit logs and VPC Flow Logs to cover both control-plane and in-container threats

Answer

Enable GuardDuty Malware Protection for EBS and forward container stdout to CloudWatch Logs for GuardDuty to parse

Answer

Deploy the CloudWatch agent to each pod and create Security Hub custom insights that correlate EKS audit events with runtime metrics