GuardDutyRuntimeMonitoring - association failed

Question

Hi all

I enabled Amazon GuardDuty across our Organization and launched several EC2 instances from our CIS/STIG-hardened image. The GuardDutyRuntimeMonitoring-do-not-delete SSM association shows Status: Failed for all of these instances.

I also attempted a manual run of the AmazonGuardDuty-ConfigureRuntimeMonitoringSsmPlugin document, but it failed with the messages below:

```
Initiating AmazonGuardDuty-RuntimeMonitoringSsmPlugin 1.8.0 install
Plugin aws:runShellScript ResultStatus Failed
install output: Running sh install.sh
Amazon GuardDuty agent failed to install. Retrying in 5 seconds...
Amazon GuardDuty agent failed to install. Retrying in 5 seconds...
Amazon GuardDuty agent failed to install. Retrying in 5 seconds...
Amazon GuardDuty agent failed to install. Retrying in 5 seconds...
Amazon GuardDuty agent failed to install. Retrying in 5 seconds...
The maximum number of retries has been exceeded for installing Amazon GuardDuty agent. Exiting.

```

And the following,

```
install errors: sudo: Account or password is expired, reset your password and try again
sudo: a terminal is required to read the password; either use the -S option to read from standard input or configure an askpass helper
sudo: unable to change expired password: Authentication token manipulation error
sudo: a password is required
sudo: Account or password is expired, reset your password and try again
sudo: a terminal is required to read the password; either use the -S option to read from standard input or configure an askpass helper
sudo: unable to change expired password: Authentication token manipulation error
sudo: a password is required
sudo: Account or password is expired, reset your password and try again
sudo: a terminal is required to read the password; either use the -S option to read from standard input or configure an askpass helper
sudo: unable to change expired password: Authentication token manipulation error
sudo: a password is required
sudo: Account or password is expired, reset your password and try again
sudo: a terminal is required to read the password; either use the -S option to read from standard input or configure an askpass helper
sudo: unable to change expired password: Authentication token manipulation error
sudo: a password is required
sudo: Account or password is expired, reset your password and try again
sudo: a terminal is required to read the password; either use the -S option to read from standard input or configure an askpass helper
sudo: unable to change expired password: Authentication token manipulation error
sudo: a password is required
failed to run commands: exit status 1
Failed to install package; install status Failed
```

re:Post Agent · Answer

The issue you're experiencing with the GuardDuty Runtime Monitoring SSM association failing appears to be related to sudo permissions on your CIS/STIG-hardened EC2 instances.

Based on the error messages, the GuardDuty security agent installation is failing because the sudo command is encountering expired password issues. This is likely due to the hardening configurations on your EC2 instances that have modified the default sudo behavior.

To troubleshoot and resolve this issue:

1. Check the SSM association execution history:
- Open the AWS Systems Manager console
- Navigate to Node management > State Manager
- Filter by Document Name "AmazonGuardDuty-ConfigureRuntimeMonitoringSsmPlugin"
- Select the association ID and view its execution history
- Review the failures to identify the root cause

2. Address the sudo configuration issues on your hardened instances:
- The error indicates password expiration and authentication token issues
- You may need to modify the sudo configuration to allow the SSM agent to execute commands without requiring password authentication
- Consider adding NOPASSWD exceptions for the specific commands needed by the GuardDuty agent installation

3. If the issue persists, you might need to:
- Temporarily disable and then re-enable Runtime Monitoring to recreate the SSM association
- Consider manually installing the GuardDuty security agent if automated deployment continues to fail
- Verify that your instances meet the architectural requirements and prerequisites for GuardDuty Runtime Monitoring

The GuardDuty Runtime Monitoring feature requires the security agent to be properly installed on your EC2 instances to monitor runtime behavior, including process executions, file system changes, and network connections. Without a successful agent installation, GuardDuty cannot receive the runtime events needed to detect threats at the operating system level.  
**Sources**  
[Runtime coverage and troubleshooting for Amazon EC2 instance - Amazon GuardDuty](https://docs.aws.amazon.com/guardduty/latest/ug/gdu-assess-coverage-ec2.html)  
[Navigating Amazon GuardDuty protection plans and Extended Threat Detection | AWS Security Blog](https://aws.amazon.com/blogs/security/navigating-amazon-guardduty-protection-plans-and-extended-threat-detection/)  
[Managing security agent manually for Amazon EC2 resource - Amazon GuardDuty](https://docs.aws.amazon.com/guardduty/latest/ug/managing-gdu-agent-ec2-manually.html)  
[Enabling GuardDuty agent for Amazon EC2 resources in multiple-account environment - Amazon GuardDuty](https://docs.aws.amazon.com/guardduty/latest/ug/manage-agent-ec2-multi-account-env.html)

GuardDutyRuntimeMonitoring - association failed

Add your answer

Relevant content