GuardDuty Malware Protection will retain each replica Amazon EBS volume it generates and scans for up to 24 hours. By default, replica Amazon EBS volumes are deleted a few minutes after GuardDuty Malware Protection completes a scan. In some instances, however, GuardDuty Malware Protection may need to retain a replica Amazon EBS volume for longer than 24 hours if a service outage or connection problem interferes with its malware scan. When this occurs, GuardDuty Malware Protection will retain the replica Amazon EBS volume for up to seven days to give the service time to triage and address the outage or connection problem. GuardDuty Malware Protection will delete the replica Amazon EBS volume after the outage or failure is addressed or once the extended retention period lapses.