Amazon GuardDuty

Amazon GuardDuty Guardduty Malware Scan API

The Guardduty Malware Scan API from Amazon GuardDuty — 3 operation(s) for guardduty malware scan.

GitHub OpenAPI
Business capability
Threat Detection & Response Management BC-620.30

Operations 4

POST /detector/{DetectorId}/malware-scans Describe Malware Scans #
GET /malware-scan/{ScanId} Get Malware Scan #
POST /malware-scan List Malware Scans #
POST /malware-scan/start Start Malware Scan #

Specifications

⚙
OpenAPI
https://artifacts.apis.io/amazon-guardduty/openapi/amazon-guardduty-malware-scan-api-openapi.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/amazon-guardduty:amazon-guardduty-malware-scan-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

amazon-guardduty-malware-scan-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: Amazon GuardDuty Malware Scan API
  version: '2017-11-28'
  description: Generated from AWS's published Smithy model for Amazon GuardDuty. 4 operation(s).
  contact:
    name: Amazon Web Services
    url: https://aws.amazon.com/contact-us/
  license:
    name: Apache 2.0
    identifier: Apache-2.0
    url: https://github.com/aws/api-models-aws/blob/main/LICENSE
servers:
- url: https://guardduty.{region}.amazonaws.com
  variables:
    region:
      default: us-east-1
security:
- sigv4: []
tags:
- name: Malware Scan
paths:
  /detector/{DetectorId}/malware-scans:
    post:
      operationId: DescribeMalwareScans
      summary: Describe Malware Scans
      description: Returns a list of malware scans. Each member account can view the malware scans for their own accounts. An administrator can view the malware scans for all the member accounts. There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints.
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DescribeMalwareScansResponse'
        '400':
          description: BadRequestException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestException'
        '500':
          description: InternalServerErrorException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalServerErrorException'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DescribeMalwareScansRequest'
      tags:
      - Malware Scan
  /malware-scan/{ScanId}:
    get:
      operationId: GetMalwareScan
      summary: Get Malware Scan
      description: Retrieves the detailed information for a specific malware scan. Each member account can view the malware scan details for their own account. An administrator can view malware scan details for all accounts in the organization. There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints.
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetMalwareScanResponse'
        '400':
          description: BadRequestException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestException'
        '500':
          description: InternalServerErrorException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalServerErrorException'
        '404':
          description: ResourceNotFoundException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResourceNotFoundException'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/GetMalwareScanRequest'
      tags:
      - Malware Scan
  /malware-scan:
    post:
      operationId: ListMalwareScans
      summary: List Malware Scans
      description: Returns a list of malware scans. Each member account can view the malware scans for their own accounts. An administrator can view the malware scans for all of its members' accounts.
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListMalwareScansResponse'
        '400':
          description: BadRequestException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestException'
        '500':
          description: InternalServerErrorException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalServerErrorException'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ListMalwareScansRequest'
      tags:
      - Malware Scan
  /malware-scan/start:
    post:
      operationId: StartMalwareScan
      summary: Start Malware Scan
      description: Initiates the malware scan. Invoking this API will automatically create the Service-linked role in the corresponding account if the resourceArn belongs to an EC2 instance. When the malware scan starts, you can use the associated scan ID to track the status of the scan. For more information, see ListMalwareScans and GetMalwareScan. When you use this API, the Amazon Web Services service terms for GuardDuty Malware Protection apply. For more information, see Amazon Web Services service terms for GuardDuty Malware Protection.
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/StartMalwareScanResponse'
        '400':
          description: BadRequestException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestException'
        '409':
          description: ConflictException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ConflictException'
        '500':
          description: InternalServerErrorException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalServerErrorException'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/StartMalwareScanRequest'
      tags:
      - Malware Scan
components:
  schemas:
    ResourceNotFoundException:
      type: object
      properties:
        Message:
          type: string
          description: The error message.
        Type:
          type: string
          description: The error type.
    RecoveryPoint:
      type: object
      properties:
        BackupVaultName:
          type: string
          description: The name of the Amazon Web Services Backup vault that contains the name of the recovery point to be scanned.
        ContinuousScanDetails:
          $ref: '#/components/schemas/ContinuousScanDetails'
      required:
      - BackupVaultName
    StartMalwareScanRequest:
      type: object
      properties:
        ResourceArn:
          type: string
          description: Amazon Resource Name (ARN) of the resource for which you invoked the API.
        ClientToken:
          type: string
          description: The idempotency token for the create request.
        ScanConfiguration:
          $ref: '#/components/schemas/StartMalwareScanConfiguration'
      required:
      - ResourceArn
    StartMalwareScanConfiguration:
      type: object
      properties:
        Role:
          type: string
          description: Amazon Resource Name (ARN) of the IAM role that is used for scanning the resource.
        IncrementalScanDetails:
          $ref: '#/components/schemas/IncrementalScanDetails'
        RecoveryPoint:
          $ref: '#/components/schemas/RecoveryPoint'
      required:
      - Role
    AdditionalInfo:
      type: object
      properties:
        VersionId:
          type: string
          description: The version ID of the S3 object, if applicable.
        DeviceName:
          type: string
          description: The device name of the EBS volume, if applicable.
    BadRequestException:
      type: object
      properties:
        Message:
          type: string
          description: The error message.
        Type:
          type: string
          description: The error type.
    ListMalwareScansFilterCriterion:
      type: object
      properties:
        ListMalwareScansCriterionKey:
          type: string
          enum:
          - RESOURCE_ARN
          - SCAN_ID
          - ACCOUNT_ID
          - GUARDDUTY_FINDING_ID
          - RESOURCE_TYPE
          - SCAN_START_TIME
          - SCAN_STATUS
          - SCAN_TYPE
          description: An enum value representing possible scan properties to match with given scan entries.
        FilterCondition:
          $ref: '#/components/schemas/FilterCondition'
    ConflictException:
      type: object
      properties:
        Message:
          type: string
          description: The error message.
        Type:
          type: string
          description: The error type.
    GetMalwareScanResponse:
      type: object
      properties:
        ScanId:
          type: string
          description: A unique identifier associated with the malware scan. Each malware scan has a corresponding scan ID. Using this scan ID, you can monitor the status of your malware scan.
        DetectorId:
          type: string
          description: The unique ID of the detector that is associated with the request, if it belongs to an account which is a GuardDuty customer. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API.
        AdminDetectorId:
          type: string
          description: The unique detector ID of the administrator account that the request is associated with. If the account is an administrator, the AdminDetectorId will be the same as the one used for DetectorId. If the customer is not a GuardDuty customer, this field will not be present.. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API.
        ResourceArn:
          type: string
          description: Amazon Resource Name (ARN) of the resource on which a malware scan was invoked.
        ResourceType:
          type: string
          enum:
          - EBS_RECOVERY_POINT
          - EBS_SNAPSHOT
          - EBS_VOLUME
          - EC2_AMI
          - EC2_INSTANCE
          - EC2_RECOVERY_POINT
          - S3_RECOVERY_POINT
          - S3_BUCKET
          - S3_POINT_IN_TIME_RECOVERY
          description: The type of resource that was scanned for malware.
        ScannedResourcesCount:
          type: integer
          description: The total number of resources that were successfully scanned. This is dependent on the resource type.
        SkippedResourcesCount:
          type: integer
          description: The total number of resources that were skipped during the scan.
        FailedResourcesCount:
          type: integer
          description: The total number of resources that failed to be scanned.
        ScannedResources:
          type: array
          items:
            $ref: '#/components/schemas/ScannedResource'
          description: A list of resources along with their metadata that were scanned as part of the malware scan operation.
        ScanConfiguration:
          $ref: '#/components/schemas/ScanConfiguration'
        ScanCategory:
          type: string
          enum:
          - FULL_SCAN
          - INCREMENTAL_SCAN
          description: The category of the malware scan, indicating the type of scan performed.
        ScanStatus:
          type: string
          enum:
          - RUNNING
          - COMPLETED
          - COMPLETED_WITH_ISSUES
          - FAILED
          - SKIPPED
          description: A value representing the current status of the malware scan.
        ScanStatusReason:
          type: string
          enum:
          - ACCESS_DENIED
          - RESOURCE_NOT_FOUND
          - SNAPSHOT_SIZE_LIMIT_EXCEEDED
          - RESOURCE_UNAVAILABLE
          - INCONSISTENT_SOURCE
          - INCREMENTAL_NO_DIFFERENCE
          - NO_EBS_VOLUMES_FOUND
          - UNSUPPORTED_PRODUCT_CODE_TYPE
          - AMI_SNAPSHOT_LIMIT_EXCEEDED
          - UNRELATED_RESOURCES
          - BASE_RESOURCE_NOT_SCANNED
          - BASE_CREATED_AFTER_TARGET
          - UNSUPPORTED_FOR_INCREMENTAL
          - UNSUPPORTED_AMI
          - UNSUPPORTED_SNAPSHOT
          - UNSUPPORTED_COMPOSITE_RECOVERY_POINT
          - ALL_FILES_SKIPPED_OR_FAILED
          description: Represents the reason for the current scan status, if applicable.
        ScanType:
          type: string
          enum:
          - BACKUP_INITIATED
          - ON_DEMAND
          - GUARDDUTY_INITIATED
          description: A value representing the initiator of the scan.
        ScanStartedAt:
          type: string
          format: date-time
          description: The timestamp representing when the malware scan was started.
        ScanCompletedAt:
          type: string
          format: date-time
          description: The timestamp representing when the malware scan was completed.
        ScanResultDetails:
          $ref: '#/components/schemas/GetMalwareScanResultDetails'
    ScanConfigurationRecoveryPoint:
      type: object
      properties:
        BackupVaultName:
          type: string
          description: The name of the Amazon Web Services Backup vault that contains the recovery point for the scanned.
        ContinuousScanDetails:
          $ref: '#/components/schemas/ScanConfigurationContinuousScanDetails'
    ContinuousScanDetails:
      type: object
      properties:
        StartTime:
          type: string
          format: date-time
          description: The timestamp representing the start of the time range to scan. Reserved for internal use.
        EndTime:
          type: string
          format: date-time
          description: The timestamp representing the end of the time range to scan.
      required:
      - EndTime
    GetMalwareScanRequest:
      type: object
      properties:
        ScanId:
          type: string
          description: A unique identifier that gets generated when you invoke the API without any error. Each malware scan has a corresponding scan ID. Using this scan ID, you can monitor the status of your malware scan.
      required:
      - ScanId
    ScanConfigurationContinuousScanDetails:
      type: object
      properties:
        StartTime:
          type: string
          format: date-time
          description: The timestamp representing the start of the time range that was scanned.
        EndTime:
          type: string
          format: date-time
          description: The timestamp representing the end of the time range that was scanned.
      required:
      - EndTime
    ScanResultDetails:
      type: object
      properties:
        ScanResult:
          type: string
          enum:
          - CLEAN
          - INFECTED
          description: An enum value representing possible scan results.
    ScanConfiguration:
      type: object
      properties:
        Role:
          type: string
          description: Amazon Resource Name (ARN) of the IAM role that should contain the required permissions for the scan.
        TriggerDetails:
          $ref: '#/components/schemas/TriggerDetails'
        IncrementalScanDetails:
          $ref: '#/components/schemas/IncrementalScanDetails'
        RecoveryPoint:
          $ref: '#/components/schemas/ScanConfigurationRecoveryPoint'
    FilterCondition:
      type: object
      properties:
        EqualsValue:
          type: string
          description: Represents an equal condition to be applied to a single field when querying for scan entries.
        GreaterThan:
          type: integer
          description: Represents a greater than condition to be applied to a single field when querying for scan entries.
        LessThan:
          type: integer
          description: Represents a less than condition to be applied to a single field when querying for scan entries.
    ScannedResourceDetails:
      type: object
      properties:
        EbsVolume:
          $ref: '#/components/schemas/VolumeDetail'
        EbsSnapshot:
          $ref: '#/components/schemas/EbsSnapshot'
    MalwareScan:
      type: object
      properties:
        ResourceArn:
          type: string
          description: Amazon Resource Name (ARN) of the resource for the given malware scan.
        ResourceType:
          type: string
          enum:
          - EBS_RECOVERY_POINT
          - EBS_SNAPSHOT
          - EBS_VOLUME
          - EC2_AMI
          - EC2_INSTANCE
          - EC2_RECOVERY_POINT
          - S3_RECOVERY_POINT
          - S3_BUCKET
          - S3_POINT_IN_TIME_RECOVERY
          description: The type of resource that was scanned for malware.
        ScanId:
          type: string
          description: A unique identifier that gets generated when you invoke the API without any error. Each malware scan has a corresponding scan ID. Using this scan ID, you can monitor the status of your malware scan.
        ScanStatus:
          type: string
          enum:
          - RUNNING
          - COMPLETED
          - COMPLETED_WITH_ISSUES
          - FAILED
          - SKIPPED
          description: An enum value representing the current status of the malware scan.
        ScanResultStatus:
          type: string
          enum:
          - NO_THREATS_FOUND
          - THREATS_FOUND
          description: An enum value representing the result of the malware scan.
        ScanType:
          type: string
          enum:
          - BACKUP_INITIATED
          - ON_DEMAND
          - GUARDDUTY_INITIATED
          description: An enum value representing the type of scan that was initiated.
        ScanStartedAt:
          type: string
          format: date-time
          description: The timestamp representing when the malware scan was started.
        ScanCompletedAt:
          type: string
          format: date-time
          description: The timestamp representing when the malware scan was completed.
    ListMalwareScansRequest:
      type: object
      properties:
        MaxResults:
          type: integer
          description: You can use this parameter to indicate the maximum number of items that you want in the response. The default value is 50. The maximum value is 50.
        NextToken:
          type: string
          description: You can use this parameter when paginating results. Set the value of this parameter to null on your first call to the list action. For subsequent calls to the action, fill nextToken in the request with the value of NextToken from the previous response to continue listing results.
        FilterCriteria:
          $ref: '#/components/schemas/ListMalwareScansFilterCriteria'
        SortCriteria:
          $ref: '#/components/schemas/SortCriteria'
    FilterCriterion:
      type: object
      properties:
        CriterionKey:
          type: string
          enum:
          - EC2_INSTANCE_ARN
          - SCAN_ID
          - ACCOUNT_ID
          - GUARDDUTY_FINDING_ID
          - SCAN_START_TIME
          - SCAN_STATUS
          - SCAN_TYPE
          description: An enum value representing possible scan properties to match with given scan entries.
        FilterCondition:
          $ref: '#/components/schemas/FilterCondition'
    DescribeMalwareScansRequest:
      type: object
      properties:
        DetectorId:
          type: string
          description: The unique ID of the detector that the request is associated with. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API.
        NextToken:
          type: string
          description: You can use this parameter when paginating results. Set the value of this parameter to null on your first call to the list action. For subsequent calls to the action, fill nextToken in the request with the value of NextToken from the previous response to continue listing data.
        MaxResults:
          type: integer
          description: You can use this parameter to indicate the maximum number of items that you want in the response. The default value is 50. The maximum value is 50.
        FilterCriteria:
          $ref: '#/components/schemas/FilterCriteria'
        SortCriteria:
          $ref: '#/components/schemas/SortCriteria'
      required:
      - DetectorId
    ScanResultThreat:
      type: object
      properties:
        Name:
          type: string
          description: The name of the detected threat.
        Source:
          type: string
          enum:
          - AMAZON
          - BITDEFENDER
          description: The source that detected this threat.
        Count:
          type: integer
          description: The number of instances of this threat that were detected.
        Hash:
          type: string
          description: The hash value associated with the detected threat.
        ItemDetails:
          type: array
          items:
            $ref: '#/components/schemas/ItemDetails'
          description: Additional information about where this threat was detected.
    Scan:
      type: object
      properties:
        DetectorId:
          type: string
          description: The unique ID of the detector that is associated with the request. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API.
        AdminDetectorId:
          type: string
          description: The unique detector ID of the administrator account that the request is associated with. If the account is an administrator, the AdminDetectorId will be the same as the one used for DetectorId. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API.
        ScanId:
          type: string
          description: The unique scan ID associated with a scan entry.
        ScanStatus:
          type: string
          enum:
          - RUNNING
          - COMPLETED
          - FAILED
          - SKIPPED
          description: An enum value representing possible scan statuses.
        FailureReason:
          type: string
          description: Represents the reason for FAILED scan status.
        ScanStartTime:
          type: string
          format: date-time
          description: The timestamp of when the scan was triggered.
        ScanEndTime:
          type: string
          format: date-time
          description: The timestamp of when the scan was finished.
        TriggerDetails:
          $ref: '#/components/schemas/TriggerDetails'
        ResourceDetails:
          $ref: '#/components/schemas/ResourceDetails'
        ScanResultDetails:
          $ref: '#/components/schemas/ScanResultDetails'
        AccountId:
          type: string
          description: The ID for the account that belongs to the scan.
        TotalBytes:
          type: integer
          description: Represents total bytes that were scanned.
        FileCount:
          type: integer
          description: Represents the number of files that were scanned.
        AttachedVolumes:
          type: array
          items:
            $ref: '#/components/schemas/VolumeDetail'
          description: List of volumes that were attached to the original instance to be scanned.
        ScanType:
          type: string
          enum:
          - GUARDDUTY_INITIATED
          - ON_DEMAND
          description: Specifies the scan type that invoked the malware scan.
    VolumeDetail:
      type: object
      properties:
        VolumeArn:
          type: string
          description: EBS volume ARN information.
        VolumeType:
          type: string
          description: The EBS volume type.
        DeviceName:
          type: string
          description: The device name for the EBS volume.
        VolumeSizeInGB:
          type: integer
          description: EBS volume size in GB.
        EncryptionType:
          type: string
          description: EBS volume encryption type.
        SnapshotArn:
          type: string
          description: Snapshot ARN of the EBS volume.
        KmsKeyArn:
          type: string
          description: KMS key ARN used to encrypt the EBS volume.
    ListMalwareScansResponse:
      type: object
      properties:
        Scans:
          type: array
          items:
            $ref: '#/components/schemas/MalwareScan'
          description: The list of malware scans associated with the provided input parameters.
        NextToken:
          type: string
          description: The pagination parameter to be used on the next list operation to retrieve more scans.
      required:
      - Scans
    GetMalwareScanResultDetails:
      type: object
      properties:
        ScanResultStatus:
          type: string
          enum:
          - NO_THREATS_FOUND
          - THREATS_FOUND
          description: Status indicating whether threats were found for a completed scan.
        SkippedFileCount:
          type: integer
          description: The total number of files that were skipped during the scan.
        FailedFileCount:
          type: integer
          description: The total number of files that failed to be scanned.
        ThreatFoundFileCount:
          type: integer
          description: The total number of files in which threats were detected.
        TotalFileCount:
          type: integer
          description: The total number of files that were processed during the scan.
        TotalBytes:
          type: integer
          description: The total number of bytes that were scanned.
        UniqueThreatCount:
          type: integer
          description: The total number of unique threats that were detected during the scan.
        Threats:
          type: array
          items:
            $ref: '#/components/schemas/ScanResultThreat'
          description: The threats that were detected during the malware scan.
    EbsSnapshot:
      type: object
      properties:
        DeviceName:
          type: string
          description: The device name of the EBS snapshot that was scanned.
    SortCriteria:
      type: object
      properties:
        AttributeName:
          type: string
          description: Represents the finding attribute, such as accountId, that sorts the findings.
        OrderBy:
          type: string
          enum:
          - ASC
          - DESC
          description: The order by which the sorted findings are to be displayed.
    DescribeMalwareScansResponse:
      type: object
      properties:
        Scans:
          type: array
          items:
            $ref: '#/components/schemas/Scan'
          description: Contains information about malware scans associated with GuardDuty Malware Protection for EC2.
        NextToken:
          type: string
          description: The pagination parameter to be used on the next list operation to retrieve more items.
      required:
      - Scans
    InternalServerErrorException:
      type: object
      properties:
        Message:
          type: string
          description: The error message.
        Type:
          type: string
          description: The error type.
    StartMalwareScanResponse:
      type: object
      properties:
        ScanId:
          type: string
          description: A unique identifier that gets generated when you invoke the API without any error. Each malware scan has a corresponding scan ID. Using this scan ID, you can monitor the status of your malware scan.
    FilterCriteria:
      type: object
      properties:
        FilterCriterion:
          type: array
          items:
            $ref: '#/components/schemas/FilterCriterion'
          description: Represents a condition that when matched will be added to the response of the operation.
    ScannedResource:
      type: object
      properties:
        ScannedResourceArn:
          type: string
          description: Amazon Resource Name (ARN) of the scanned resource.
        ScannedResourceType:
          type: string
          enum:
          - EBS_RECOVERY_POINT
          - EBS_SNAPSHOT
          - EBS_VOLUME
          - EC2_AMI
          - EC2_INSTANCE
          - EC2_RECOVERY_POINT
          - S3_RECOVERY_POINT
          - S3_BUCKET
          - S3_POINT_IN_TIME_RECOVERY
          description: The resource type of the scanned resource.
        ScannedResourceStatus:
          type: string
          enum:
          - RUNNING
          - COMPLETED
          - COMPLETED_WITH_ISSUES
          - FAILED
          - SKIPPED
          description: The status of the scanned resource.
        ScanStatusReason:
          type: string
          enum:
          - ACCESS_DENIED
          - RESOURCE_NOT_FOUND
          - SNAPSHOT_SIZE_LIMIT_EXCEEDED
          - RESOURCE_UNAVAILABLE
          - INCONSISTENT_SOURCE
          - INCREMENTAL_NO_DIFFERENCE
          - NO_EBS_VOLUMES_FOUND
          - UNSUPPORTED_PRODUCT_CODE_TYPE
          - AMI_SNAPSHOT_LIMIT_EXCEEDED
          - UNRELATED_RESOURCES
          - BASE_RESOURCE_NOT_SCANNED
          - BASE_CREATED_AFTER_TARGET
          - UNSUPPORTED_FOR_INCREMENTAL
          - UNSUPPORTED_AMI
          - UNSUPPORTED_SNAPSHOT
          - UNSUPPORTED_COMPOSITE_RECOVERY_POINT
          - ALL_FILES_SKIPPED_OR_FAILED
          description: The reason for the scan status of this particular resource, if applicable.
        ResourceDetails:
          $ref: '#/components/schemas/ScannedResourceDetails'
    TriggerDetails:
      type: object
      properties:
        GuardDutyFindingId:
          type: string
          description: The ID of the GuardDuty finding that triggered the malware scan.
        Description:
          type: string
          description: The description of the scan trigger.
        TriggerType:
          type: string
          enum:
          - BACKUP
          - GUARDDUTY
          description: Specifies the trigger type that started the malware scan.
    ListMalwareScansFilterCriteria:
      type: object
      properties:
        ListMalwareScansFilterCriterion:
          type: array
          items:
            $ref: '#/components/schemas/ListMalwareScansFilterCriterion'
          description: Represents a condition that when matched will be added to the response of the operation.
    IncrementalScanDetails:
      type: object
      properties:
        BaselineResourceArn:
          type: string
          description: Amazon Resource Name (ARN) of the baseline resource used for incremental scanning. The scan will only process changes since this baseline resource was created.
      required:
      - BaselineResourceArn
    ResourceDetails:
      type: object
      properties:
        InstanceArn:
          type: string
          description: Instance ARN that was scanned in the scan entry.
    ItemDetails:
      type: object
      properties:
        ResourceArn:
          type: string
          description: Amazon Resource Name (ARN) of the resource where the threat was detected.
        ItemPath:
          type: string
          description: The path where the threat was detected.
        Hash:
          type: string
          description: The hash value of the infected item.
        AdditionalInfo:
          $ref: '#/components/schemas/AdditionalInfo'
  securitySchemes:
    sigv4:
      type: apiKey
      in: header
      name: Authorization
      description: AWS Signature Version 4. The Authorization header carries an AWS4-HMAC-SHA256 signature over the canonical request, with X-Amz-Date (and X-Amz-Security-Token for temporary credentials). Not a bearer token.
      x-aws-sigv4:
        signingName: guardduty
x-provenance:
  method: harvested
  publisher: Amazon Web Services
  source: https://raw.githubusercontent.com/aws/api-models-aws/582e55931c45b944739742a2c1620b6026dd2d13/models/guardduty/service/2017-11-28/guardduty-2017-11-28.json
  note: converted by smithy-to-openapi.py from AWS's Smithy model (roadmap#1001)