Set up snapshot retention and EC2 scan coverage
This section explains how to customize malware scanning options for your Amazon EC2 instances. These customizations apply to both On-demand malware scan and those initiated by GuardDuty. You can do the following:
-
Enable snapshot retention – When enabled before a scan, GuardDuty will retain the Amazon EBS snapshot that GuardDuty detected as malicious.
-
Choose which Amazon EC2 instances to scan – Use tags to include or exclude specific Amazon EC2 instances from malware scans.
Snapshots retention
GuardDuty provides you with the option to retain the snapshots of your EBS volumes in your Amazon account. By default, the snapshots retention setting is turned off. The snapshots will only be retained if you have this setting turned on before the scan initiates.
As the scan initiates, GuardDuty generates the replica EBS volumes based on the snapshots of your EBS volumes. After the scan completes and the snapshots retention setting in your account was turned on already, the snapshots of your EBS volumes will be retained only when malware is found and Malware Protection for EC2 finding types get generated. When no malware is found, then regardless of your snapshot settings, GuardDuty automatically deletes the snapshots of your EBS volumes unless Amazon EBS snapshot locking has been enabled on the created snapshots.
Snapshots usage cost
During the malware scanning, as GuardDuty creates the snapshots of your Amazon EBS volumes, there
is a usage cost associated with this step. If you turn on the snapshots retention setting
for your account, when malware is found and the snapshots get retained, you will incur usage
cost for the same. For information about cost of snapshots and their retention, see Amazon EBS pricing
As a delegated GuardDuty administrator account, only you can make this update on behalf of the organization member accounts. However, if a member account is managed by invitation method, they can make this change on their own. For more information, see Administrator account and member account relationships.
Choose your preferred access method to turn on the snapshots retention setting.
Scan options with user-defined tags
By using GuardDuty-initiated malware scan, you can also specify tags to either include or exclude Amazon EC2 instances and Amazon EBS volumes from the scanning and threat detection process. You can customize each GuardDuty-initiated malware scan by editing tags in either the inclusion or exclusion tags list. Each list can include up to 50 tags.
If you don't already have user-defined tags associated to your EC2 resources, see Tag your Amazon EC2 resources in the Amazon EC2 User Guide.
Note
On-demand malware scan doesn't support scan options with user-defined tags. It supports Global GuardDutyExcluded tag.
To exclude EC2 instances from malware scan
If you want to exclude any Amazon EC2 instance or Amazon EBS volume during the scanning process,
you can set the GuardDutyExcluded tag to true for any Amazon EC2
instance or Amazon EBS volume, and GuardDuty won't scan it. For more information about
GuardDutyExcluded tag, see Service-linked role permissions for
Malware Protection for EC2. You can also add an Amazon EC2 instance
tag to an exclusion list. If you add multiple tags to the exclusion tags list, any Amazon EC2
instance that contains at least one of these tags will be excluded from the malware scanning
process.
As a delegated GuardDuty administrator account, only you can make this update on behalf of the organization member accounts. However, if a member account is managed by invitation method, they can make this change on their own. For more information, see Administrator account and member account relationships.
Choose your preferred access method to add a tag associated with an Amazon EC2 instance, to an exclusion list.
To include EC2 instances in malware scan
If you want to scan an EC2 instance, add its tag to the inclusion list. When you add a tag to an inclusion tags list, an EC2 instance that doesn't contain any of the added tags is skipped from the malware scan. If you add multiple tags to the inclusion tags list, an EC2 instance that contains at least one of those tags is included in the malware scan. Sometimes, an EC2 instance may be skipped during the scanning process because of other reasons. For more information, see Reasons for skipping resource during malware scan.
As a delegated GuardDuty administrator account, only you can make this update on behalf of the organization member accounts. However, if a member account is managed by invitation method, they can make this change on their own. For more information, see Administrator account and member account relationships.
Choose your preferred access method to add a tag associated with an EC2 instance, to an inclusion list.
Note
It may take up to 5 minutes for GuardDuty to detect a new tag.
At any time, you can either choose Inclusion tags or Exclusion tags but not both. If you want to switch between the tags, choose that tag from the dropdown menu when you add new tags, and Confirm your selection. This action clears all your current tags.
Global GuardDutyExcluded
tag
GuardDuty uses a global tag key, GuardDutyExcluded, that you can add to your Amazon EC2 resources and set the tag value to true. This
Amazon EC2 resource that has this tag key and value pair will be excluded from the malware scan. Both the scan types (GuardDuty-initiated malware scan and On-demand malware scan) support the global tag. If you start an on-demand malware scan
on an Amazon EC2, a scan ID will be generated. However, the scan will be skipped
with an EXCLUDED_BY_SCAN_SETTINGS reason. For more information, see Reasons for skipping resource during malware
scan.