How to Fix AWS GuardDuty S3 Malware Scans Not Running

Select Language:

Here’s how you can troubleshoot and likely resolve the issue with your plugin causing unwanted behavior:

First, review your event filtering rules, especially the ObjectPrefixes, to ensure they are correctly defined. For your pre-production environment, the prefix should be */uploads/, and for your development environment, it should include prefixes like /uploads/, /attachments/, /tool-results/, and /analysis/. Check that your test paths match these patterns. For example, a test path like repro-{ts}/uploads/... should align with the pre-production prefix, and 1000TEST/repro-{ts}/uploads/... should match the development prefixes. Confirm these patterns in your configuration.

Next, verify the storage class and object size of your test files. Use a method like the head-object command to check your files from around April 26. Your files should have a storage class like STANDARD, and their sizes should be between 55 and 69 bytes, not empty or stored in Glacier. These details matter because certain storage classes or incorrect object sizes could affect scan results.

Finally, check for any conflicts with delegated administrator settings. Use the appropriate command or interface to examine your organization’s configuration. Ensure that features like Malware Protection are properly enabled and configured. If Malware Protection isn’t listed at all, that indicates a wider configuration issue.

In your case, the pre-production environment hasn’t been changed since its creation on April 26. It successfully detected malware scans at that time, but now it shows zero activity, even though no settings have been altered. This suggests the problem isn’t with your configuration but instead points to a backend issue in how AWS synchronizes the organization-level settings with individual resources. Since all indicators are at zero, this might be a backend synchronization problem that only AWS support can resolve.

If you don’t have a paid support plan, reaching out to AWS support or your account manager is the best route. They will have the tools necessary to investigate and fix this backend issue to restore the expected functionality.