- Home
- Cloud Detection and Response Software
- Amazon GuardDuty
Amazon GuardDuty
What it is
Amazon GuardDuty monitors AWS accounts and workloads for malicious activity and produces security findings. Its detection draws on AI, machine learning, anomaly detection, and AWS and third-party threat intelligence. The service analyzes sources such as CloudTrail, VPC Flow, DNS, S3 data events, Aurora login events, AWS Backup, AI workload activity, and runtime activity. Runtime Monitoring covers EKS, ECS workloads including those on Fargate, and EC2 instances. GuardDuty can scan EC2-attached EBS volumes after suspicious activity and detect potentially harmful uploads to S3. AI Protection looks for threats such as unusual model invocations, cost harvesting, and prompt injection attempts in Amazon Bedrock and SageMaker workloads. Findings can be routed to AWS Security Hub, EventBridge, Amazon Detective, or third-party solutions. Foundational protections do not require additional security software or infrastructure to deploy and maintain. Charges depend on analyzed data and vary by source and Region. New accounts in supported Regions can receive a 30-day free trial; some features are unavailable in some Regions.
For and against
For
- Monitors multiple AWS log and activity sources
- Runtime Monitoring covers EKS, ECS, Fargate, and EC2
- Findings can route to AWS and third-party tools
- 30-day trial available in supported Regions
Against
- No free plan
- Some features unavailable in some Regions
- Charges vary by data source and Region
The verdict
GuardDuty brings threat detection and security findings across several AWS workload types and data sources. Trial availability, feature coverage, and charges depend on Region and data source.
Who it suits
It is intended for organizations seeking threat detection across AWS accounts, compute, storage, database, and AI workloads. It may suit teams that route security findings into existing event management and response workflows.
Plans and prices
30-day free trial
Malware Protection for S3 has a separate free tier · on-demand EC2 scans and AWS Backup malware scans excluded
Read 14 Oct 2026 · docs.aws.amazon.com
Malware Protection for EBS
additional EBS snapshot charges may apply
Read 14 Oct 2026 · aws.amazon.com
Malware Protection for S3
US East example · regional pricing varies
Read 14 Oct 2026 · aws.amazon.com
Foundational threat detection — VPC Flow Logs and DNS query logs
volume discounts · regional pricing varies
Read 14 Oct 2026 · aws.amazon.com
Foundational threat detection — CloudTrail management events
US East example · regional pricing varies
Read 14 Oct 2026 · aws.amazon.com
Amazon GuardDuty
30-day free trial in supported Regions for new accounts; protection plans can have separate trials; Malware Protection for Amazon S3 has a free tier without a trial period
Read 2 Oct 2026 · aws.amazon.com
On the record
- Account threat detection
- It identifies unusual geolocation, atypical API calls, attempts to disable CloudTrail, suspicious infrastructure launches and other signs of account compromise.aws.amazon.com · read 14 Oct 2026
- AI Protection
- AI Protection detects anomalous Bedrock and SageMaker model invocations, cost-harvesting attacks and prompt injection through Bedrock Guardrails integration.docs.aws.amazon.com · read 14 Oct 2026
- CLI and console
- Users can operate GuardDuty through the browser console, AWS CLI, HTTPS API or AWS SDKs.docs.aws.amazon.com · read 14 Oct 2026
- Company facts
- LinkedIn lists Amazon Web Services as headquartered in Seattle, launched in 2006, with 148,106 employees shown on its global page.linkedin.com · read 14 Oct 2026
- Company legal name
- The launch announcement identifies the maker as Amazon Web Services Inc., an Amazon.com company.press.aboutamazon.com · read 14 Oct 2026
- Compute protection
- Runtime Monitoring covers EKS, ECS workloads including those on Fargate, and EC2 instances.aws.amazon.com · read 2 Oct 2026
- Container protection
- GuardDuty monitors EKS audit logs and runtime activity in EKS and ECS, including Fargate workloads, for container compromise.aws.amazon.com · read 14 Oct 2026
- Data sources
- GuardDuty analyzes CloudTrail logs, VPC Flow Logs, DNS query logs, S3 data events, Aurora login events, AWS Backup data, AI workload activity, and runtime activity.aws.amazon.com · read 2 Oct 2026
- Deployment
- Foundational GuardDuty protections require no additional security software or infrastructure to deploy and maintain.aws.amazon.com · read 2 Oct 2026
- Detection methods
- GuardDuty uses AI, machine learning, anomaly detection, and AWS and third-party threat intelligence to detect threats.aws.amazon.com · read 2 Oct 2026
- Documentation depth
- AWS publishes a user guide, API reference, CLI reference, setup tutorials, finding-type catalog, regional availability, security guidance and a dated document history.docs.aws.amazon.com · read 14 Oct 2026
- Extended investigations
- AI-powered investigations in preview analyze findings, 90 days of related activity, threat indicators and affected resources, then provide confidence scores and remediation recommendations.aws.amazon.com · read 14 Oct 2026
- Instance compromise
- Detection covers cryptocurrency mining, command-and-control activity, domain-generation algorithms, unusual protocols, malicious IP communications and DNS exfiltration.aws.amazon.com · read 14 Oct 2026
- Integrations
- GuardDuty findings can be routed to AWS Security Hub, Amazon EventBridge, Amazon Detective, or third-party solutions.aws.amazon.com · read 2 Oct 2026
- Intended users
- GuardDuty is for organizations seeking threat detection across AWS accounts, workloads, and data, including compute, storage, database, and AI workloads.aws.amazon.com · read 2 Oct 2026
- Lambda protection
- Lambda Protection analyzes network activity logs generated by Lambda executions for serverless-specific threats.aws.amazon.com · read 14 Oct 2026
- Limit: alert handling
- G2 reviewers say teams must integrate GuardDuty with monitored platforms or SIEMs because console-only alerts can be missed and larger environments need triage processes.g2.com · read 14 Oct 2026
- Limit: detection scope
- G2 reviewers criticize its mainly rule-based approach, saying novel threats outside known patterns may be missed and GuardDuty detects rather than actively blocks threats.g2.com · read 14 Oct 2026
