Uninstalling security agent manually

To uninstall the GuardDuty security agent by using Run command

1. You can uninstall the GuardDuty security agent by following the steps as specified in AWS Systems Manager Run Command in the AWS Systems Manager User Guide. Use the Uninstall action in the parameters to uninstall the GuardDuty security agent.

   In the Targets section, make sure that the impact is only on those Amazon EC2 instances from which you want to uninstall the security agent.

   Use the following GuardDuty document and distributor:

   • Document name: AmazonGuardDuty-ConfigureRuntimeMonitoringSsmPlugin

   • Distributor: AmazonGuardDuty-RuntimeMonitoringSsmPlugin

2. After providing all the details, when you choose Run, the security agent that it deployed on the targeted Amazon EC2 instances is removed.

   To remove the Amazon VPC endpoint configuration, you must disable both Runtime Monitoring and Amazon EKS Runtime Monitoring.

1. Connect with SSH from Linux or macOS.

2. Command to uninstall

   The following command will uninstall the GuardDuty security agent from the Amazon EC2 instance to which you connect:

   • For RPM:

     sudo rpm -e amazon-guardduty-agent

   • For Debian:

     sudo dpkg --purge amazon-guardduty-agent

   After you run the command, you can also check the logs associated with the command.

To delete the Amazon VPC endpoint by using the console

1. Open the Amazon VPC console at https://console.aws.amazon.com/vpc/.

2. In the navigation pane, choose Endpoints.

3. Select the endpoint that was created manually at the time of enabling Runtime Monitoring.

4. Choose Actions, Delete VPC endpoints.

5. When prompted for confirmation, enter delete.

6. Choose Delete.