hashicorp#25994 docs

Author: nick

website/docs/r/guardduty_detector.html.markdown

@@ -27,6 +27,13 @@ resource "aws_guardduty_detector" "MyDetector" {
         enable = false
       }
     }
+    malware_protection {
+      scan_ec2_instance_with_findings {
+        ebs_volumes {
+          enable = true
+        }
+      }
+    }
   }
 }
 ```
@@ -48,6 +55,8 @@ The `datasources` block supports the following:
   See [S3 Logs](#s3-logs) below for more details.
 * `kubernetes` - (Optional) Configures [Kubernetes protection](https://docs.aws.amazon.com/guardduty/latest/ug/kubernetes-protection.html).
   See [Kubernetes](#kubernetes) and [Kubernetes Audit Logs](#kubernetes-audit-logs) below for more details.
+* `malware_protection` - (Optional) Configures [Malware Protection](https://docs.aws.amazon.com/guardduty/latest/ug/malware-protection.html).
+  See [Malware Protection](#malware-protection), [Scan EC2 instance with findings](#scan-ec2-instance-with-findings) and [EBS volumes](#ebs-volumes) below for more details.
 
 ### S3 Logs
 
@@ -70,6 +79,24 @@ The `audit_logs` block supports the following:
 * `enable` - (Required) If true, enables Kubernetes audit logs as a data source for [Kubernetes protection](https://docs.aws.amazon.com/guardduty/latest/ug/kubernetes-protection.html).
   Defaults to `true`.
 
+### Malware Protection
+`malware_protection` block supports the following:
+
+* `scan_ec2_instance_with_findings` - (Required) Configure whether [Malware Protection](https://docs.aws.amazon.com/guardduty/latest/ug/malware-protection.html) is enabled as data source for EC2 instances with findings for the detector.
+  See [Scan EC2 instance with findings](#scan-ec2-instance-with-findings) below for more details.
+
+#### Scan EC2 instance with findings
+The `scan_ec2_instance_with_findings` block supports the following:
+
+* `ebs_volumes` - (Required) Configure whether scanning EBS volumes is enabled as data source for the detector for instances with findings.
+  See [EBS volumes](#ebs-volumes) below for more details.
+
+#### EBS volumes
+The `ebs_volumes` block supports the following:
+
+* `enable` - (Required) If true, enables [Malware Protection](https://docs.aws.amazon.com/guardduty/latest/ug/malware-protection.html) as data source for the detector.
+  Defaults to `true`.
+
 ## Attributes Reference
 
 In addition to all arguments above, the following attributes are exported: