Orchestrate automated response for Amazon GuardDuty Malware Protection for AWS Backup at scale

This post demonstrates a quarantine solution that automatically tags infected recovery points, enforces organization-level restore denial, and notifies security teams in real time when Amazon GuardDuty detects malware in AWS Backup. The architecture uses EventBridge and Lambda to couple malware detection with automated prevention, stopping compromised backups from reaching production environments at scale.