Question

A security team manages several Amazon EKS clusters and wants GuardDuty to detect suspicious activity such as anonymous API access, privileged container launches, and use of exposed Kubernetes credentials by analyzing control-plane activity. They do not want to deploy any agents onto the worker nodes at this stage. Which GuardDuty capability should they enable to meet this requirement?

Accepted Answer

Enable EKS Protection, which analyzes Kubernetes audit logs without requiring any agent on the nodes

Answer

Enable EKS Runtime Monitoring with the GuardDuty security agent deployed to each node

Answer

Enable Malware Protection for EC2 to scan the underlying node EBS volumes

Answer

Enable Runtime Monitoring for ECS Fargate to inspect the containerized workloads