AWS guardduty documentation change
Summary
Clarified SSM requirement applies only to automated agent configuration, added Fedora 40/41 support, and removed Fedora-related limitations
Security assessment
The changes clarify when SSM is required, preventing potential misconfigurations. Adding Fedora 40/41 to supported OS ensures users know these distributions are now covered by runtime monitoring, improving security visibility. However, there's no evidence this addresses an active security vulnerability.
Diff
diff --git a/guardduty/latest/ug/prereq-runtime-monitoring-ec2-support.md b/guardduty/latest/ug/prereq-runtime-monitoring-ec2-support.md index ee224b512..113655f9b 100644 --- a//guardduty/latest/ug/prereq-runtime-monitoring-ec2-support.md +++ b//guardduty/latest/ug/prereq-runtime-monitoring-ec2-support.md @@ -5 +5 @@ -Make EC2 instances SSM managedValidate architectural requirementsValidating your organization service control policy in a multi-account environmentWhen using automated agent configurationCPU and memory limitNext step +Make EC2 instances SSM managed (for automated agent only)Validate architectural requirementsValidating your organization service control policy in a multi-account environmentWhen using automated agent configurationCPU and memory limitNext step @@ -13 +13 @@ This section includes the prerequisites for monitoring runtime behavior of your - * Make EC2 instances SSM managed + * Make EC2 instances SSM managed (for automated agent configuration only) @@ -28 +28 @@ This section includes the prerequisites for monitoring runtime behavior of your -## Make EC2 instances SSM managed +## Make EC2 instances SSM managed (for automated agent configuration only) @@ -30 +30 @@ This section includes the prerequisites for monitoring runtime behavior of your -The Amazon EC2 instances for which you want GuardDuty to monitor runtime events must be AWS Systems Manager (SSM) managed. This is regardless of whether you use GuardDuty to manage the security agent automatically, or manage it manually. However, when you manage the agent manually by using the manual [Method 2 - Using Linux Package Managers](./installing-gdu-security-agent-ec2-manually.html#install-gdu-by-rpm-scripts-runtime-monitoring), there is no need for your EC2 instances to be SSM managed. +GuardDuty uses AWS Systems Manager (SSM) to automatically deploy, install, and manage the security agent on your instances. If you plan to manually install and manage the GuardDuty agent, SSM is not required. @@ -32,7 +32 @@ The Amazon EC2 instances for which you want GuardDuty to monitor runtime events -To manage your Amazon EC2 instances with AWS Systems Manager, see [Setting up Systems Manager for Amazon EC2 instances](https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-setting-up-ec2.html) in the _AWS Systems Manager User Guide_. - -###### Note for Fedora-based EC2 instances - -AWS Systems Manager doesn't support the _Fedora_ OS distribution. After enabling Runtime Monitoring, use the manual method ([Method 2 - Using Linux Package Managers](./installing-gdu-security-agent-ec2-manually.html#install-gdu-by-rpm-scripts-runtime-monitoring)) to install the security agent in Fedora-based EC2 instances. - -For information about supported platforms, see [Supported package platforms and architectures](https://docs.aws.amazon.com/systems-manager/latest/userguide/distributor.html#what-is-a-package-platforms) in the _AWS Systems Manager User Guide_. +To manage your Amazon EC2 instances with Systems Manager, see [Setting up Systems Manager for Amazon EC2 instances](https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-setting-up-ec2.html) in the _AWS Systems Manager User Guide_. @@ -56 +50,3 @@ RedHat 9.4 | 5.14 -Fedora5 34.0 | 5.11, 5.17 +Fedora 34.0 | 5.11, 5.17 +Fedora 40 | 6.8 +Fedora 41 | 6.12 @@ -70,2 +65,0 @@ Rocky Linux 9.5 | 5.14 - 5. Fedora is not a supported platform for automated agent configuration. You can deploy the GuardDuty security agent on Fedora by using [Method 2 - Using Linux Package Managers](./installing-gdu-security-agent-ec2-manually.html#install-gdu-by-rpm-scripts-runtime-monitoring). -