Orchestrate automated response for Amazon GuardDuty Malware Protection for AWS Backup at scale

This article explains how to implement automated malware detection and response for AWS Backup recovery points using GuardDuty, preventing infected backups from being restored to production.

• GuardDuty Malware Protection scans backups; EventBridge triggers Lambda to tag infected recovery points
• Service Control Policies deny restore operations on tagged infected recovery points organization-wide
• Lambda function also sends SNS notifications to security teams and optionally copies infected backups to forensics account
• Solution uses phased rollout: foundation setup, pilot testing, scaling, and operational maturity
• Tiered scanning strategy matches scan frequency to workload criticality to optimize costs
• Centralized visibility through Security Hub aggregation in delegated administrator account

This automated enforcement prevents compromised backups from reaching production during incidents by coupling detection with prevention at the organizational level.