Malware Protection

Amazon GuardDuty Malware Protection for AWS Backup scans a backup recovery point for malware. It answers a different question than Backup Vault Lock does: Vault Lock proves a recovery point hasn't been tampered with or deleted after the fact, malware scanning tells you whether the data inside it was already infected before it was ever backed up. Restoring from an unscanned recovery point after a ransomware incident can just as easily restore the ransomware along with it, scanning lets you identify the last clean recovery point instead.

What It Scans

Supported resource types: EC2, EBS, and S3 only. This is a hard limitation of GuardDuty Malware Protection itself, not something NTC Backup or NTC Account Factory restrict. RDS, Aurora, Neptune, DocumentDB, DynamoDB, and EFS recovery points cannot be scanned, regardless of resource_types configuration on either module.

Automatic scanning only covers the local recovery point

NTC Backup can wire scanning directly into the BACKUP_POLICY documents it generates (see Automatic Scanning below), but only for the recovery point a backup plan rule creates directly - the local (member account) vault. AWS Backup's plan-based scanning binds to the rule that creates a recovery point, not to any downstream copy_action, so a recovery point copied into this entry's central vault is never automatically scanned. GuardDuty's own docs confirm copied recovery points are a distinct, more limited case (incremental scanning isn't supported on them at all). Scanning the central copy is still on-demand only, see Running an On-Demand Scan below.

Automatic Scanning (NTC Backup)

Set malware_scanning on a backup_definitions[] entry to add scanning to that entry's generated backup plan - off by default:

{
  name   = "ntc-central-backup-vault-eu-central-1"
  region = "eu-central-1"
  # ...

  # Must match the local scanner role name from the account baseline template's "backup" template.
  member_account_malware_scanner_role_name = "ntc-local-backup-malware-scanner-role"

  malware_scanning = {
    enabled        = true
    resource_types = ["EC2", "EBS", "S3"] # or "ALL" - whichever of these three this entry's own resource_types includes
    scan_mode      = "INCREMENTAL_SCAN"   # or "FULL_SCAN"
  }
}

• enabled - turns automatic scanning on for this entry's local vault recovery points.
• resource_types - which of this entry's own resource_types to scan. Anything outside EC2/EBS/S3 has nothing to scan and is silently ignored.
• scan_mode - INCREMENTAL_SCAN (only files changed since the last scan, cheaper) or FULL_SCAN (every file, every time).

The scanner IAM roles themselves (malware_scan_scanner_iam_role_name centrally, member_account_malware_scanner_role_name locally) are always created, independent of this setting - so an on-demand scan against any existing recovery point works even with malware_scanning.enabled = false everywhere.

Running an On-Demand Scan

Start a scan from either the AWS Backup console (Malware protection section) or the GuardDuty console (Malware scans), or via the StartMalwareScan (GuardDuty) / start-scan-job (AWS Backup) API or CLI. Either way, you'll be asked to specify a backup role and a scanner role. Use the pair for wherever the recovery point actually lives:

	Central (backup account)	Local (member account)
Backup role	ntc-central-backup-operator-role	ntc-local-backup-operator-role
Scanner role	ntc-central-backup-malware-scanner-role	ntc-local-backup-malware-scanner-role

Choose a scan type per invocation:

• Full scan - scans every file in the recovery point.
• Incremental scan - scans only what changed against a base recovery point of the same resource. The first scan of any resource is always a full scan regardless of what you request, GuardDuty needs a baseline before it can do incremental comparisons.

Checking Scan Results

A scan job's State field (CREATED, RUNNING, COMPLETED, COMPLETED_WITH_ISSUES, FAILED, CANCELED) does not itself explain a failure, check the separate StatusMessage field instead, either in the AWS Backup console's job detail view or via aws backup describe-scan-job --scan-job-id <id>. The GuardDuty console's Malware scans page also shows its own, often more granular, status for the same scan.