c2.12 Deploy anti-malware / EDR where you own the OS
The shared responsibility model decides who runs anti-malware. For managed and serverless services (RDS, S3) AWS handles it. For infrastructure services like EC2, you own OS hardening, patching, and endpoint protection — deploy an anti-malware / EDR agent on every such instance.
Implementation guidance
Who is responsible
Under the shared responsibility model:
- Managed and serverless services — such as Amazon RDS or Amazon S3 — give you no OS access, so AWS manages, updates, and monitors the underlying protection for you.
- Infrastructure services — such as Amazon EC2 — leave you responsible for OS hardening, patching the OS and applications, and running anti-malware / EDR (endpoint detection and response) / runtime protection.
Protect every instance you manage
Deploy an anti-malware / EDR / runtime-protection solution on each instance to detect and stop ransomware, trojans, and worms. Partner solutions such as CrowdStrike and Trend Micro are available on the AWS Marketplace. For container and instance workloads, GuardDuty Runtime Monitoring adds runtime threat detection that complements — but does not replace — endpoint protection.
Do not forget user endpoints
Protect the endpoints of your AWS users too, especially administrators — a compromised admin laptop is a direct path into the environment.
How to validate
- Do you run anti-malware / EDR / runtime protection on the instances you manage?
- What percentage of your instances are covered?
- Are all operating systems in use covered, not just Windows?
- Are user endpoints — especially administrators — protected as well?
Threats addressed
- Malware can take remote control of your instances, encrypt your data (ransomware), or use them to launch further attacks across your infrastructure.
AWS services
Amazon EC2