aws-sdk-guardduty 1.58.0 → 1.60.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 869d806801afa2b4a5b1949bdd1b98811394238075eb5cd043307213363c7ff8
-  data.tar.gz: f8299da7691c031486b83fab3756f0a68ab368063298bf7c51c0c1855f2616d9
+  metadata.gz: c816009d91648e8c1ec630881cc3be9ce5728800b209a5a60e6805d3a406ebd9
+  data.tar.gz: 62f153a02a619f120aef19a2d220327afe96b32dad43d619b6be8ca96214ec00
 SHA512:
-  metadata.gz: 5df5248b5ae3aeba4793aee592e9989d0713252d024e682a16836e0abd57a31b85115ec8eb4efc700e7cbe7fc71a67e26acd93a8e4cc2552a8fbdca5157b5093
-  data.tar.gz: 790c45ba079457076e7e16367adc07b9d12bfa8c264b449e3cfaf91e16f82f745f65d30961126913d2a65f831fb52f086f2b49081c4a2dd3d845766e15e14e29
+  metadata.gz: cdf81633dcd4ce86f6dfc92b614f509f93b397147faea8daf473e515b2290fbcab12415e6ddf9bd0de089a00204ff6841fa7be066dcc1edb7ddc1bcb696fc171
+  data.tar.gz: 5cc93b75797ddc0933e0a2b6eb6e0f72db8d205f9dca9148e4208499b2bc940a45fd0d71a9051b038462bb62d606bbfe74565e6dd008ff0ed33e195ff0178d30

data/CHANGELOG.md

@@ -1,6 +1,16 @@
 Unreleased Changes
 ------------------
 
+1.60.0 (2022-10-13)
+------------------
+
+* Feature - Add UnprocessedDataSources to CreateDetectorResponse which specifies the data sources that couldn't be enabled during the CreateDetector request. In addition, update documentations.
+
+1.59.0 (2022-07-26)
+------------------
+
+* Feature - Amazon GuardDuty introduces a new Malware Protection feature that triggers malware scan on selected EC2 instance resources, after the service detects a potentially malicious activity.
+
 1.58.0 (2022-06-15)
 ------------------
 

data/VERSION

@@ -1 +1 @@
-1.58.0
+1.60.0

data/lib/aws-sdk-guardduty/client.rb

@@ -477,6 +477,7 @@ module Aws::GuardDuty
     # @return [Types::CreateDetectorResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
     #
     #   * {Types::CreateDetectorResponse#detector_id #detector_id} => String
+    #   * {Types::CreateDetectorResponse#unprocessed_data_sources #unprocessed_data_sources} => Types::UnprocessedDataSourcesResult
     #
     # @example Request syntax with placeholder values
     #
@@ -493,6 +494,11 @@ module Aws::GuardDuty
     #           enable: false, # required
     #         },
     #       },
+    #       malware_protection: {
+    #         scan_ec2_instance_with_findings: {
+    #           ebs_volumes: false,
+    #         },
+    #       },
     #     },
     #     tags: {
     #       "TagKey" => "TagValue",
@@ -502,6 +508,9 @@ module Aws::GuardDuty
     # @example Response structure
     #
     #   resp.detector_id #=> String
+    #   resp.unprocessed_data_sources.malware_protection.scan_ec2_instance_with_findings.ebs_volumes.status #=> String, one of "ENABLED", "DISABLED"
+    #   resp.unprocessed_data_sources.malware_protection.scan_ec2_instance_with_findings.ebs_volumes.reason #=> String
+    #   resp.unprocessed_data_sources.malware_protection.service_role #=> String
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/guardduty-2017-11-28/CreateDetector AWS API Documentation
     #
@@ -1222,6 +1231,99 @@ module Aws::GuardDuty
       req.send_request(options)
     end
 
+    # Returns a list of malware scans. Each member account can view the
+    # malware scans for their own accounts. An administrator can view the
+    # malware scans for all the member accounts.
+    #
+    # @option params [required, String] :detector_id
+    #   The unique ID of the detector that the request is associated with.
+    #
+    # @option params [String] :next_token
+    #   You can use this parameter when paginating results. Set the value of
+    #   this parameter to null on your first call to the list action. For
+    #   subsequent calls to the action, fill nextToken in the request with the
+    #   value of NextToken from the previous response to continue listing
+    #   data.
+    #
+    # @option params [Integer] :max_results
+    #   You can use this parameter to indicate the maximum number of items
+    #   that you want in the response. The default value is 50. The maximum
+    #   value is 50.
+    #
+    # @option params [Types::FilterCriteria] :filter_criteria
+    #   Represents the criteria to be used in the filter for describing scan
+    #   entries.
+    #
+    # @option params [Types::SortCriteria] :sort_criteria
+    #   Represents the criteria used for sorting scan entries.
+    #
+    # @return [Types::DescribeMalwareScansResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
+    #
+    #   * {Types::DescribeMalwareScansResponse#scans #scans} => Array<Types::Scan>
+    #   * {Types::DescribeMalwareScansResponse#next_token #next_token} => String
+    #
+    # The returned {Seahorse::Client::Response response} is a pageable response and is Enumerable. For details on usage see {Aws::PageableResponse PageableResponse}.
+    #
+    # @example Request syntax with placeholder values
+    #
+    #   resp = client.describe_malware_scans({
+    #     detector_id: "DetectorId", # required
+    #     next_token: "String",
+    #     max_results: 1,
+    #     filter_criteria: {
+    #       filter_criterion: [
+    #         {
+    #           criterion_key: "EC2_INSTANCE_ARN", # accepts EC2_INSTANCE_ARN, SCAN_ID, ACCOUNT_ID, GUARDDUTY_FINDING_ID, SCAN_START_TIME, SCAN_STATUS
+    #           filter_condition: {
+    #             equals_value: "NonEmptyString",
+    #             greater_than: 1,
+    #             less_than: 1,
+    #           },
+    #         },
+    #       ],
+    #     },
+    #     sort_criteria: {
+    #       attribute_name: "String",
+    #       order_by: "ASC", # accepts ASC, DESC
+    #     },
+    #   })
+    #
+    # @example Response structure
+    #
+    #   resp.scans #=> Array
+    #   resp.scans[0].detector_id #=> String
+    #   resp.scans[0].admin_detector_id #=> String
+    #   resp.scans[0].scan_id #=> String
+    #   resp.scans[0].scan_status #=> String, one of "RUNNING", "COMPLETED", "FAILED"
+    #   resp.scans[0].failure_reason #=> String
+    #   resp.scans[0].scan_start_time #=> Time
+    #   resp.scans[0].scan_end_time #=> Time
+    #   resp.scans[0].trigger_details.guard_duty_finding_id #=> String
+    #   resp.scans[0].trigger_details.description #=> String
+    #   resp.scans[0].resource_details.instance_arn #=> String
+    #   resp.scans[0].scan_result_details.scan_result #=> String, one of "CLEAN", "INFECTED"
+    #   resp.scans[0].account_id #=> String
+    #   resp.scans[0].total_bytes #=> Integer
+    #   resp.scans[0].file_count #=> Integer
+    #   resp.scans[0].attached_volumes #=> Array
+    #   resp.scans[0].attached_volumes[0].volume_arn #=> String
+    #   resp.scans[0].attached_volumes[0].volume_type #=> String
+    #   resp.scans[0].attached_volumes[0].device_name #=> String
+    #   resp.scans[0].attached_volumes[0].volume_size_in_gb #=> Integer
+    #   resp.scans[0].attached_volumes[0].encryption_type #=> String
+    #   resp.scans[0].attached_volumes[0].snapshot_arn #=> String
+    #   resp.scans[0].attached_volumes[0].kms_key_arn #=> String
+    #   resp.next_token #=> String
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/guardduty-2017-11-28/DescribeMalwareScans AWS API Documentation
+    #
+    # @overload describe_malware_scans(params = {})
+    # @param [Hash] params ({})
+    def describe_malware_scans(params = {}, options = {})
+      req = build_request(:describe_malware_scans, params)
+      req.send_request(options)
+    end
+
     # Returns information about the account selected as the delegated
     # administrator for GuardDuty.
     #
@@ -1247,6 +1349,7 @@ module Aws::GuardDuty
     #   resp.member_account_limit_reached #=> Boolean
     #   resp.data_sources.s3_logs.auto_enable #=> Boolean
     #   resp.data_sources.kubernetes.audit_logs.auto_enable #=> Boolean
+    #   resp.data_sources.malware_protection.scan_ec2_instance_with_findings.ebs_volumes.auto_enable #=> Boolean
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/guardduty-2017-11-28/DescribeOrganizationConfiguration AWS API Documentation
     #
@@ -1370,8 +1473,8 @@ module Aws::GuardDuty
       req.send_request(options)
     end
 
-    # Disassociates GuardDuty member accounts (to the current GuardDuty
-    # administrator account) specified by the account IDs.
+    # Disassociates GuardDuty member accounts (to the current administrator
+    # account) specified by the account IDs.
     #
     # @option params [required, String] :detector_id
     #   The unique ID of the detector of the GuardDuty account whose members
@@ -1496,6 +1599,9 @@ module Aws::GuardDuty
     #   resp.data_sources.flow_logs.status #=> String, one of "ENABLED", "DISABLED"
     #   resp.data_sources.s3_logs.status #=> String, one of "ENABLED", "DISABLED"
     #   resp.data_sources.kubernetes.audit_logs.status #=> String, one of "ENABLED", "DISABLED"
+    #   resp.data_sources.malware_protection.scan_ec2_instance_with_findings.ebs_volumes.status #=> String, one of "ENABLED", "DISABLED"
+    #   resp.data_sources.malware_protection.scan_ec2_instance_with_findings.ebs_volumes.reason #=> String
+    #   resp.data_sources.malware_protection.service_role #=> String
     #   resp.tags #=> Hash
     #   resp.tags["TagKey"] #=> String
     #
@@ -1697,6 +1803,63 @@ module Aws::GuardDuty
     #   resp.findings[0].resource.kubernetes_details.kubernetes_workload_details.volumes[0].name #=> String
     #   resp.findings[0].resource.kubernetes_details.kubernetes_workload_details.volumes[0].host_path.path #=> String
     #   resp.findings[0].resource.resource_type #=> String
+    #   resp.findings[0].resource.ebs_volume_details.scanned_volume_details #=> Array
+    #   resp.findings[0].resource.ebs_volume_details.scanned_volume_details[0].volume_arn #=> String
+    #   resp.findings[0].resource.ebs_volume_details.scanned_volume_details[0].volume_type #=> String
+    #   resp.findings[0].resource.ebs_volume_details.scanned_volume_details[0].device_name #=> String
+    #   resp.findings[0].resource.ebs_volume_details.scanned_volume_details[0].volume_size_in_gb #=> Integer
+    #   resp.findings[0].resource.ebs_volume_details.scanned_volume_details[0].encryption_type #=> String
+    #   resp.findings[0].resource.ebs_volume_details.scanned_volume_details[0].snapshot_arn #=> String
+    #   resp.findings[0].resource.ebs_volume_details.scanned_volume_details[0].kms_key_arn #=> String
+    #   resp.findings[0].resource.ebs_volume_details.skipped_volume_details #=> Array
+    #   resp.findings[0].resource.ebs_volume_details.skipped_volume_details[0].volume_arn #=> String
+    #   resp.findings[0].resource.ebs_volume_details.skipped_volume_details[0].volume_type #=> String
+    #   resp.findings[0].resource.ebs_volume_details.skipped_volume_details[0].device_name #=> String
+    #   resp.findings[0].resource.ebs_volume_details.skipped_volume_details[0].volume_size_in_gb #=> Integer
+    #   resp.findings[0].resource.ebs_volume_details.skipped_volume_details[0].encryption_type #=> String
+    #   resp.findings[0].resource.ebs_volume_details.skipped_volume_details[0].snapshot_arn #=> String
+    #   resp.findings[0].resource.ebs_volume_details.skipped_volume_details[0].kms_key_arn #=> String
+    #   resp.findings[0].resource.ecs_cluster_details.name #=> String
+    #   resp.findings[0].resource.ecs_cluster_details.arn #=> String
+    #   resp.findings[0].resource.ecs_cluster_details.status #=> String
+    #   resp.findings[0].resource.ecs_cluster_details.active_services_count #=> Integer
+    #   resp.findings[0].resource.ecs_cluster_details.registered_container_instances_count #=> Integer
+    #   resp.findings[0].resource.ecs_cluster_details.running_tasks_count #=> Integer
+    #   resp.findings[0].resource.ecs_cluster_details.tags #=> Array
+    #   resp.findings[0].resource.ecs_cluster_details.tags[0].key #=> String
+    #   resp.findings[0].resource.ecs_cluster_details.tags[0].value #=> String
+    #   resp.findings[0].resource.ecs_cluster_details.task_details.arn #=> String
+    #   resp.findings[0].resource.ecs_cluster_details.task_details.definition_arn #=> String
+    #   resp.findings[0].resource.ecs_cluster_details.task_details.version #=> String
+    #   resp.findings[0].resource.ecs_cluster_details.task_details.task_created_at #=> Time
+    #   resp.findings[0].resource.ecs_cluster_details.task_details.started_at #=> Time
+    #   resp.findings[0].resource.ecs_cluster_details.task_details.started_by #=> String
+    #   resp.findings[0].resource.ecs_cluster_details.task_details.tags #=> Array
+    #   resp.findings[0].resource.ecs_cluster_details.task_details.tags[0].key #=> String
+    #   resp.findings[0].resource.ecs_cluster_details.task_details.tags[0].value #=> String
+    #   resp.findings[0].resource.ecs_cluster_details.task_details.volumes #=> Array
+    #   resp.findings[0].resource.ecs_cluster_details.task_details.volumes[0].name #=> String
+    #   resp.findings[0].resource.ecs_cluster_details.task_details.volumes[0].host_path.path #=> String
+    #   resp.findings[0].resource.ecs_cluster_details.task_details.containers #=> Array
+    #   resp.findings[0].resource.ecs_cluster_details.task_details.containers[0].container_runtime #=> String
+    #   resp.findings[0].resource.ecs_cluster_details.task_details.containers[0].id #=> String
+    #   resp.findings[0].resource.ecs_cluster_details.task_details.containers[0].name #=> String
+    #   resp.findings[0].resource.ecs_cluster_details.task_details.containers[0].image #=> String
+    #   resp.findings[0].resource.ecs_cluster_details.task_details.containers[0].image_prefix #=> String
+    #   resp.findings[0].resource.ecs_cluster_details.task_details.containers[0].volume_mounts #=> Array
+    #   resp.findings[0].resource.ecs_cluster_details.task_details.containers[0].volume_mounts[0].name #=> String
+    #   resp.findings[0].resource.ecs_cluster_details.task_details.containers[0].volume_mounts[0].mount_path #=> String
+    #   resp.findings[0].resource.ecs_cluster_details.task_details.containers[0].security_context.privileged #=> Boolean
+    #   resp.findings[0].resource.ecs_cluster_details.task_details.group #=> String
+    #   resp.findings[0].resource.container_details.container_runtime #=> String
+    #   resp.findings[0].resource.container_details.id #=> String
+    #   resp.findings[0].resource.container_details.name #=> String
+    #   resp.findings[0].resource.container_details.image #=> String
+    #   resp.findings[0].resource.container_details.image_prefix #=> String
+    #   resp.findings[0].resource.container_details.volume_mounts #=> Array
+    #   resp.findings[0].resource.container_details.volume_mounts[0].name #=> String
+    #   resp.findings[0].resource.container_details.volume_mounts[0].mount_path #=> String
+    #   resp.findings[0].resource.container_details.security_context.privileged #=> Boolean
     #   resp.findings[0].schema_version #=> String
     #   resp.findings[0].service.action.action_type #=> String
     #   resp.findings[0].service.action.aws_api_call_action.api #=> String
@@ -1786,6 +1949,32 @@ module Aws::GuardDuty
     #   resp.findings[0].service.user_feedback #=> String
     #   resp.findings[0].service.additional_info.value #=> String
     #   resp.findings[0].service.additional_info.type #=> String
+    #   resp.findings[0].service.feature_name #=> String
+    #   resp.findings[0].service.ebs_volume_scan_details.scan_id #=> String
+    #   resp.findings[0].service.ebs_volume_scan_details.scan_started_at #=> Time
+    #   resp.findings[0].service.ebs_volume_scan_details.scan_completed_at #=> Time
+    #   resp.findings[0].service.ebs_volume_scan_details.trigger_finding_id #=> String
+    #   resp.findings[0].service.ebs_volume_scan_details.sources #=> Array
+    #   resp.findings[0].service.ebs_volume_scan_details.sources[0] #=> String
+    #   resp.findings[0].service.ebs_volume_scan_details.scan_detections.scanned_item_count.total_gb #=> Integer
+    #   resp.findings[0].service.ebs_volume_scan_details.scan_detections.scanned_item_count.files #=> Integer
+    #   resp.findings[0].service.ebs_volume_scan_details.scan_detections.scanned_item_count.volumes #=> Integer
+    #   resp.findings[0].service.ebs_volume_scan_details.scan_detections.threats_detected_item_count.files #=> Integer
+    #   resp.findings[0].service.ebs_volume_scan_details.scan_detections.highest_severity_threat_details.severity #=> String
+    #   resp.findings[0].service.ebs_volume_scan_details.scan_detections.highest_severity_threat_details.threat_name #=> String
+    #   resp.findings[0].service.ebs_volume_scan_details.scan_detections.highest_severity_threat_details.count #=> Integer
+    #   resp.findings[0].service.ebs_volume_scan_details.scan_detections.threat_detected_by_name.item_count #=> Integer
+    #   resp.findings[0].service.ebs_volume_scan_details.scan_detections.threat_detected_by_name.unique_threat_name_count #=> Integer
+    #   resp.findings[0].service.ebs_volume_scan_details.scan_detections.threat_detected_by_name.shortened #=> Boolean
+    #   resp.findings[0].service.ebs_volume_scan_details.scan_detections.threat_detected_by_name.threat_names #=> Array
+    #   resp.findings[0].service.ebs_volume_scan_details.scan_detections.threat_detected_by_name.threat_names[0].name #=> String
+    #   resp.findings[0].service.ebs_volume_scan_details.scan_detections.threat_detected_by_name.threat_names[0].severity #=> String
+    #   resp.findings[0].service.ebs_volume_scan_details.scan_detections.threat_detected_by_name.threat_names[0].item_count #=> Integer
+    #   resp.findings[0].service.ebs_volume_scan_details.scan_detections.threat_detected_by_name.threat_names[0].file_paths #=> Array
+    #   resp.findings[0].service.ebs_volume_scan_details.scan_detections.threat_detected_by_name.threat_names[0].file_paths[0].file_path #=> String
+    #   resp.findings[0].service.ebs_volume_scan_details.scan_detections.threat_detected_by_name.threat_names[0].file_paths[0].volume_arn #=> String
+    #   resp.findings[0].service.ebs_volume_scan_details.scan_detections.threat_detected_by_name.threat_names[0].file_paths[0].hash #=> String
+    #   resp.findings[0].service.ebs_volume_scan_details.scan_detections.threat_detected_by_name.threat_names[0].file_paths[0].file_name #=> String
     #   resp.findings[0].severity #=> Float
     #   resp.findings[0].title #=> String
     #   resp.findings[0].type #=> String
@@ -1918,6 +2107,44 @@ module Aws::GuardDuty
       req.send_request(options)
     end
 
+    # Returns the details of the malware scan settings.
+    #
+    # @option params [required, String] :detector_id
+    #   The unique ID of the detector that the scan setting is associated
+    #   with.
+    #
+    # @return [Types::GetMalwareScanSettingsResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
+    #
+    #   * {Types::GetMalwareScanSettingsResponse#scan_resource_criteria #scan_resource_criteria} => Types::ScanResourceCriteria
+    #   * {Types::GetMalwareScanSettingsResponse#ebs_snapshot_preservation #ebs_snapshot_preservation} => String
+    #
+    # @example Request syntax with placeholder values
+    #
+    #   resp = client.get_malware_scan_settings({
+    #     detector_id: "DetectorId", # required
+    #   })
+    #
+    # @example Response structure
+    #
+    #   resp.scan_resource_criteria.include #=> Hash
+    #   resp.scan_resource_criteria.include["ScanCriterionKey"].map_equals #=> Array
+    #   resp.scan_resource_criteria.include["ScanCriterionKey"].map_equals[0].key #=> String
+    #   resp.scan_resource_criteria.include["ScanCriterionKey"].map_equals[0].value #=> String
+    #   resp.scan_resource_criteria.exclude #=> Hash
+    #   resp.scan_resource_criteria.exclude["ScanCriterionKey"].map_equals #=> Array
+    #   resp.scan_resource_criteria.exclude["ScanCriterionKey"].map_equals[0].key #=> String
+    #   resp.scan_resource_criteria.exclude["ScanCriterionKey"].map_equals[0].value #=> String
+    #   resp.ebs_snapshot_preservation #=> String, one of "NO_RETENTION", "RETENTION_WITH_FINDING"
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/guardduty-2017-11-28/GetMalwareScanSettings AWS API Documentation
+    #
+    # @overload get_malware_scan_settings(params = {})
+    # @param [Hash] params ({})
+    def get_malware_scan_settings(params = {}, options = {})
+      req = build_request(:get_malware_scan_settings, params)
+      req.send_request(options)
+    end
+
     # Provides the details for the GuardDuty administrator account
     # associated with the current GuardDuty member account.
     #
@@ -1980,6 +2207,9 @@ module Aws::GuardDuty
     #   resp.member_data_source_configurations[0].data_sources.flow_logs.status #=> String, one of "ENABLED", "DISABLED"
     #   resp.member_data_source_configurations[0].data_sources.s3_logs.status #=> String, one of "ENABLED", "DISABLED"
     #   resp.member_data_source_configurations[0].data_sources.kubernetes.audit_logs.status #=> String, one of "ENABLED", "DISABLED"
+    #   resp.member_data_source_configurations[0].data_sources.malware_protection.scan_ec2_instance_with_findings.ebs_volumes.status #=> String, one of "ENABLED", "DISABLED"
+    #   resp.member_data_source_configurations[0].data_sources.malware_protection.scan_ec2_instance_with_findings.ebs_volumes.reason #=> String
+    #   resp.member_data_source_configurations[0].data_sources.malware_protection.service_role #=> String
     #   resp.unprocessed_accounts #=> Array
     #   resp.unprocessed_accounts[0].account_id #=> String
     #   resp.unprocessed_accounts[0].result #=> String
@@ -2070,6 +2300,7 @@ module Aws::GuardDuty
     #   resp.accounts[0].data_sources.flow_logs.free_trial_days_remaining #=> Integer
     #   resp.accounts[0].data_sources.s3_logs.free_trial_days_remaining #=> Integer
     #   resp.accounts[0].data_sources.kubernetes.audit_logs.free_trial_days_remaining #=> Integer
+    #   resp.accounts[0].data_sources.malware_protection.scan_ec2_instance_with_findings.free_trial_days_remaining #=> Integer
     #   resp.unprocessed_accounts #=> Array
     #   resp.unprocessed_accounts[0].account_id #=> String
     #   resp.unprocessed_accounts[0].result #=> String
@@ -2175,7 +2406,7 @@ module Aws::GuardDuty
     #     usage_statistic_type: "SUM_BY_ACCOUNT", # required, accepts SUM_BY_ACCOUNT, SUM_BY_DATA_SOURCE, SUM_BY_RESOURCE, TOP_RESOURCES
     #     usage_criteria: { # required
     #       account_ids: ["AccountId"],
-    #       data_sources: ["FLOW_LOGS"], # required, accepts FLOW_LOGS, CLOUD_TRAIL, DNS_LOGS, S3_LOGS, KUBERNETES_AUDIT_LOGS
+    #       data_sources: ["FLOW_LOGS"], # required, accepts FLOW_LOGS, CLOUD_TRAIL, DNS_LOGS, S3_LOGS, KUBERNETES_AUDIT_LOGS, EC2_MALWARE_SCAN
     #       resources: ["String"],
     #     },
     #     unit: "String",
@@ -2190,7 +2421,7 @@ module Aws::GuardDuty
     #   resp.usage_statistics.sum_by_account[0].total.amount #=> String
     #   resp.usage_statistics.sum_by_account[0].total.unit #=> String
     #   resp.usage_statistics.sum_by_data_source #=> Array
-    #   resp.usage_statistics.sum_by_data_source[0].data_source #=> String, one of "FLOW_LOGS", "CLOUD_TRAIL", "DNS_LOGS", "S3_LOGS", "KUBERNETES_AUDIT_LOGS"
+    #   resp.usage_statistics.sum_by_data_source[0].data_source #=> String, one of "FLOW_LOGS", "CLOUD_TRAIL", "DNS_LOGS", "S3_LOGS", "KUBERNETES_AUDIT_LOGS", "EC2_MALWARE_SCAN"
     #   resp.usage_statistics.sum_by_data_source[0].total.amount #=> String
     #   resp.usage_statistics.sum_by_data_source[0].total.unit #=> String
     #   resp.usage_statistics.sum_by_resource #=> Array
@@ -2651,7 +2882,13 @@ module Aws::GuardDuty
     # @option params [String] :only_associated
     #   Specifies whether to only return associated members or to return all
     #   members (including members who haven't been invited yet or have been
-    #   disassociated).
+    #   disassociated). Member accounts must have been previously associated
+    #   with the GuardDuty administrator account using [ `Create Members`
+    #   ][1].
+    #
+    #
+    #
+    #   [1]: https://docs.aws.amazon.com/guardduty/latest/APIReference/API_CreateMembers.html
     #
     # @return [Types::ListMembersResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
     #
@@ -3052,6 +3289,11 @@ module Aws::GuardDuty
     #           enable: false, # required
     #         },
     #       },
+    #       malware_protection: {
+    #         scan_ec2_instance_with_findings: {
+    #           ebs_volumes: false,
+    #         },
+    #       },
     #     },
     #   })
     #
@@ -3209,6 +3451,59 @@ module Aws::GuardDuty
       req.send_request(options)
     end
 
+    # Updates the malware scan settings.
+    #
+    # @option params [required, String] :detector_id
+    #   The unique ID of the detector that specifies the GuardDuty service
+    #   where you want to update scan settings.
+    #
+    # @option params [Types::ScanResourceCriteria] :scan_resource_criteria
+    #   Represents the criteria to be used in the filter for selecting
+    #   resources to scan.
+    #
+    # @option params [String] :ebs_snapshot_preservation
+    #   An enum value representing possible snapshot preservation settings.
+    #
+    # @return [Struct] Returns an empty {Seahorse::Client::Response response}.
+    #
+    # @example Request syntax with placeholder values
+    #
+    #   resp = client.update_malware_scan_settings({
+    #     detector_id: "DetectorId", # required
+    #     scan_resource_criteria: {
+    #       include: {
+    #         "EC2_INSTANCE_TAG" => {
+    #           map_equals: [ # required
+    #             {
+    #               key: "TagKey", # required
+    #               value: "TagValue",
+    #             },
+    #           ],
+    #         },
+    #       },
+    #       exclude: {
+    #         "EC2_INSTANCE_TAG" => {
+    #           map_equals: [ # required
+    #             {
+    #               key: "TagKey", # required
+    #               value: "TagValue",
+    #             },
+    #           ],
+    #         },
+    #       },
+    #     },
+    #     ebs_snapshot_preservation: "NO_RETENTION", # accepts NO_RETENTION, RETENTION_WITH_FINDING
+    #   })
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/guardduty-2017-11-28/UpdateMalwareScanSettings AWS API Documentation
+    #
+    # @overload update_malware_scan_settings(params = {})
+    # @param [Hash] params ({})
+    def update_malware_scan_settings(params = {}, options = {})
+      req = build_request(:update_malware_scan_settings, params)
+      req.send_request(options)
+    end
+
     # Contains information on member accounts to be updated.
     #
     # @option params [required, String] :detector_id
@@ -3238,6 +3533,11 @@ module Aws::GuardDuty
     #           enable: false, # required
     #         },
     #       },
+    #       malware_protection: {
+    #         scan_ec2_instance_with_findings: {
+    #           ebs_volumes: false,
+    #         },
+    #       },
     #     },
     #   })
     #
@@ -3284,6 +3584,13 @@ module Aws::GuardDuty
     #           auto_enable: false, # required
     #         },
     #       },
+    #       malware_protection: {
+    #         scan_ec2_instance_with_findings: {
+    #           ebs_volumes: {
+    #             auto_enable: false,
+    #           },
+    #         },
+    #       },
     #     },
     #   })
     #
@@ -3387,7 +3694,7 @@ module Aws::GuardDuty
         params: params,
         config: config)
       context[:gem_name] = 'aws-sdk-guardduty'
-      context[:gem_version] = '1.58.0'
+      context[:gem_version] = '1.60.0'
       Seahorse::Client::Request.new(handlers, context)
     end