What Amazon GuardDuty is
Amazon GuardDuty is a managed threat detection service. It continuously analyzes activity in your AWS accounts and workloads, using threat intelligence (lists of known malicious IP addresses, domains and file hashes) and machine learning models, and produces a finding when it sees something suspicious. Typical examples are credentials being used from outside AWS, an EC2 instance talking to a command and control server, cryptomining, malware on a volume or in a newly uploaded S3 object, and unusual access to databases.
GuardDuty is detection, not prevention. It does not block traffic or change your resources on its own. Its value is that it tells you quickly, with enough context to act, and it does that without agents or log pipelines for the core service.
What it monitors
Foundational data sources
As soon as you enable GuardDuty in an account and Region, it starts analyzing three foundational data sources:
- AWS CloudTrail management events
- VPC flow logs from your EC2 instances
- DNS query logs
You do not need to turn on CloudTrail trails, VPC Flow Logs or Route 53 Resolver query logging yourself for this. GuardDuty reads these streams independently, and you do not need to create an S3 bucket or an AWS KMS key to get started. (A KMS key and bucket only come into play if you later choose to export findings to Amazon S3.)
Extended Threat Detection
GuardDuty also correlates individual signals over time and across resources to spot multi-stage attacks, which it reports as attack sequence findings with Critical severity. AWS calls this Extended Threat Detection. It is enabled automatically with GuardDuty at no additional cost, and AWS recommends turning on S3 Protection so it can see attacks that involve your S3 data.
Protection plans
On top of the foundational sources, you can turn on use-case focused protection plans:
- S3 Protection: analyzes CloudTrail data events for Amazon S3 to find suspicious data access, exfiltration and destruction attempts.
- EKS Protection: analyzes Kubernetes audit logs from your Amazon EKS clusters.
- Runtime Monitoring: uses a GuardDuty security agent to watch operating system, process, file and network events on Amazon EKS, Amazon EC2 and Amazon ECS (including AWS Fargate). GuardDuty can manage the agent for you, or you can manage it yourself.
- Malware Protection for EC2: scans the EBS volumes attached to EC2 instances and container workloads when GuardDuty sees suspicious behavior, with an on-demand scan option.
- Malware Protection for S3: scans newly uploaded objects in the buckets you choose. It can be used on its own, without enabling the rest of GuardDuty.
- Malware Protection for AWS Backup: scans EBS snapshots, AMIs and AWS Backup recovery points.
- RDS Protection: profiles login activity on supported Amazon Aurora and Amazon RDS databases.
- Lambda Protection: monitors network activity from your AWS Lambda functions.
- AI Protection: detects threats to workloads that use Amazon Bedrock, Amazon Bedrock AgentCore and Amazon SageMaker AI.
Not every plan is available in every Region, so check the Regions and endpoints page for the Regions you use.
What it costs to try
GuardDuty is not free, but it has a 30-day free trial. The trial applies per account and per Region: each account in an organization gets its own trial, and so does each new Region you enable. When you enable GuardDuty for the first time, it automatically turns on the protection plans except Runtime Monitoring, and includes them in the trial. Runtime Monitoring has its own trial when you enable it.
Two exceptions: on-demand malware scans and Malware Protection for S3 are not part of the 30-day trial. Malware Protection for S3 has its own free tier, and on-demand scans are billed as you use them.
During the trial, the GuardDuty console shows an estimated monthly cost for your account, and the delegated administrator can see estimates for every member account. Use that number to decide which plans to keep before the trial ends. Prices for each plan are on the GuardDuty pricing page.
Enabling GuardDuty across an organization
For anything beyond a single account, use AWS Organizations:
- From the organization’s management account, designate a delegated GuardDuty administrator account. AWS recommends a dedicated security account rather than the management account.
- GuardDuty is Regional, so designate the same delegated administrator in every Region where you use it.
- In the delegated administrator account, set the auto-enable preference: all member accounts, new member accounts only, or none. You can set this separately for each protection plan except Malware Protection for S3.
- Repeat for each Region, or automate it with infrastructure as code.
One delegated administrator can manage up to 50,000 member accounts, and it sees the findings from all of them in one place for each Region.
AWS recommends enabling GuardDuty in every Region available to your accounts, not just the ones you deploy to. Threat actors can try to create resources in Regions where you have little presence, and GuardDuty processes global service events (such as IAM and AWS STS activity) in every Region where it is enabled.
Acting on findings
A finding includes the finding type (for example, UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration.OutsideAWS), a severity of Low, Medium, High or Critical, the affected resource, and details such as the remote IP address and API calls involved. GuardDuty keeps findings for 90 days. A practical setup:
- Route findings. GuardDuty publishes every finding to Amazon EventBridge. Create rules that send High and Critical findings to your on-call channel or ticketing system, and use AWS Lambda or AWS Systems Manager Automation for well-understood responses.
- Centralize. Send findings to AWS Security Hub CSPM or your SIEM alongside other security signals, and export them to S3 if you need to keep them longer than 90 days.
- Investigate. Use the finding details first, then Amazon Detective if you need to trace activity across accounts and time.
- Tune. Use suppression rules for activity you have confirmed is expected, such as an approved vulnerability scanner, and trusted IP lists for your own addresses. Keep suppression rules narrow so Extended Threat Detection still has the signals it needs.
- Remediate. Follow the GuardDuty remediation guidance for the resource type: rotate or revoke exposed credentials, isolate and investigate compromised instances, and review bucket policies.
To check that your alerting works before a real incident, generate sample findings from the GuardDuty settings page. They are marked [SAMPLE] and are designed for testing EventBridge rules and filters.
Getting help
9Acts is an AWS Advanced Tier Services Partner and AWS MSP Partner with the AWS Level 1 MSSP Competency. If you want help rolling out GuardDuty across your accounts and building the response around it, see our security and compliance services.