How do I enable Amazon GuardDuty Malware Production for Amazon S3 via Cloudformation or CDK

Here is a link to the CloudFormation documentation for GuardDuty Malware Protection

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-guardduty-malwareprotectionplan.html

{
  "Type" : "AWS::GuardDuty::MalwareProtectionPlan",
  "Properties" : {
      "Actions" : CFNActions,
      "ProtectedResource" : CFNProtectedResource,
      "Role" : String,
      "Tags" : [ TagItem, ... ]
    }
}

In your case, you are wanting to protect S3 so the code would look like the following to specify the S3 Bucket.

{
  "Type" : "AWS::GuardDuty::MalwareProtectionPlan",
  "Properties" : {
      "Actions" : CFNActions,
      "ProtectedResource" : {
          "S3Bucket" : S3Bucket
      },
      "Role" : String,
      "Tags" : [ TagItem, ... ]
    }
}

Hope this helps!