Question

A company runs a fleet of EC2 instances processing user-uploaded files. The security team wants to detect the presence of malware on the EBS volumes attached to instances whenever GuardDuty already generates a suspicious behavior finding (such as a communication with a known command-and-control domain) for that instance, without deploying any third-party antivirus agents on the instances. Which approach meets this requirement with the least operational overhead?

Accepted Answer

Enable GuardDuty Malware Protection for EC2 so that GuardDuty automatically initiates an agentless scan of the EBS volumes when it produces a qualifying finding for an instance.

Answer

Enable Amazon Inspector for EC2 to continuously scan the instances, which will report any malware found on the attached EBS volumes.

Answer

Deploy the GuardDuty security agent to each EC2 instance to perform runtime malware scanning of the file system.

Answer

Configure AWS Config with a managed rule that flags EBS volumes containing malware and remediates them automatically.