{
  "id": 7780235,
  "title": "The Detection Layer That Was Quietly Off: GuardDuty Disabled on an AWS Account",
  "url": "https://urgent.news/2026/09/16/the-detection-layer-that-was-quietly-off-guardduty-disabled-on-an-aws",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-16T12:02:30.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/bala_paranj_059d338e44e7e/the-detection-layer-that-was-quietly-off-guardduty-disabled-on-an-aws-account-45d8"
  },
  "original_language": "en",
  "account": "An AWS account was found to have GuardDuty disabled, despite having CloudTrail logging, CloudWatch metric filters and alarms configured for unauthorized API calls. GuardDuty correlates those logs into an alert indicating a potential account compromise. This layer is critical as it checks if the recorded data looks like reconnaissance, instance compromise, or credential abuse. The configuration showed CloudTrail with multi-region enabled, monitoring with metric filters and alarms set up, but threat detection (GuardDuty) was turned off. The misconfiguration is not a resource issue but the absence of a required resource (aws_guardduty_detector). Scan tools typically don't detect this issue as it is not a resource setting. The system invariant states that an AWS account must have GuardDuty enabled with at least one detector. Enforcing this control costs only one boolean check per account per snapshot, while the cost of not enforcing it is significant until an attack goes unnoticed.",
  "summary": "✓ Human-authored analysis; AI used for formatting and proofreading. A researcher looked at an AWS account and asked a question most don't run as part of a configuration audit: is the threat-detection layer actually on? CloudTrail was logging. CloudWatch metric filters were watching for unauthorised API calls. The SNS topic was wired up. But GuardDuty was disabled. This layer correlates those logs…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}