Unable to Activate GuardDuty Malware Protection in an Organization from a Delegated Account

Question

We have an AWS Organization, designated an account for Security where we have enable GuardDuty and works fine. Today we wanted to enable the new capability of Malware Protection but when trying to enable via the Delegated Account is fails with the following message:
**"The request failed because you do not have required AWS Organization master permission."**

![Error](https://repost.aws/media/postImages/original/IM-Xfu7v-9S4iLAX5izWtHZg)

I'm a user with Administrator policy, don't know what master permission means ?

Any though ?

Kind Regards.

hayao-k · Accepted Answer

Please enable malware protection in the management account.

*`aws organizations enable-aws-service-access --service-principal malware-protection.guardduty.amazonaws.com`*

From then on, malware protection can be enabled for member accounts from a delegated administrator account.

https://docs.aws.amazon.com/guardduty/latest/ug/malware-protection.html#configure-malware-protection-multi-account

Unable to Activate GuardDuty Malware Protection in an Organization from a Delegated Account

Relevant content