Amazon GuardDuty
Managed threat detection that continuously analyzes account and network activity for malicious behavior — no agents, no rules to write.
Verified against AWS documentation · 2026-08-26
Key facts
- 01Foundational sources: CloudTrail management events, VPC Flow Logs, DNS query logs — analyzed directly by GuardDuty, you don't need to enable or pay for those logs separately
- 02Detects with threat intelligence feeds + ML anomaly detection: compromised credentials, crypto mining, unusual API calls, C2 traffic
- 03Optional protection plans bolt on per source: S3, EKS, RDS, Lambda, Runtime Monitoring, Malware Protection — toggle independently; foundational detection can't be disabled while GuardDuty is on
- 04Regional service — enable per Region; org-wide rollout via AWS Organizations with a delegated administrator account
- 05Findings are read-only detections routed to EventBridge / Security Hub — GuardDuty detects, it never blocks or remediates by itself
Exam triggers
Phrases and scenarios that point here.
- "Continuously monitor for malicious activity / compromised instances / unusual API calls" → GuardDuty
- "Threat detection with no agents or infrastructure to manage" → GuardDuty
- "EC2 instance mining cryptocurrency" or "credentials used from an unusual location" → classic GuardDuty finding scenarios
- "Automatically respond to a finding" → GuardDuty finding → EventBridge rule → Lambda/SNS (GuardDuty itself takes no action)
Not this service
- Scanning workloads for software vulnerabilities/CVEs → Inspector
- Discovering sensitive data (PII) in S3 → Macie
- Deep-dive investigation of a finding's root cause → Detective
- Aggregating security findings across services into one dashboard → Security Hub
Use cases
- 01A leaked access key starts making API calls from an IP range your team has never touched — GuardDuty flags the anomaly before the bill does
- 02An EC2 instance quietly joins a mining pool at 2 a.m.; the crypto-mining finding fires into EventBridge and a Lambda isolates the instance's security group
- 03Fresh AWS Organization with 40 accounts: one delegated admin enables GuardDuty everywhere in minutes — the fastest path to baseline threat visibility without deploying anything
- 04Compliance requires continuous threat monitoring evidence; GuardDuty findings piped to Security Hub become the audit trail
How it's charged
- 01Pay-as-you-go on volume analyzed — no upfront cost, no infrastructure
- 02Foundational: CloudTrail management events priced per million events; VPC Flow Logs + DNS logs priced per GB with volume discount tiers
- 03Each protection plan is its own meter with its own unit (S3 per data event, EKS per audit log GB, Runtime Monitoring per vCPU-hour, RDS per vCPU, malware scans per GB scanned) — cost scales with what you enable
- 0430-day free trial per account per Region shows estimated monthly spend in the console — check it before day 31, protection plans auto-enabled at activation are the usual bill-shock source
- 05EBS snapshots created for Malware Protection scans are billed separately under EBS pricing
