Amazon Detective
Security incident investigation
Automatically gathers data from CloudTrail, VPC Flow Logs, GuardDuty, EKS audit logs… into a behavior graph to investigate the root cause of a finding: who did what, from where, and when.
- Cost$$ Medium
- Difficulty●●●●●
- Costs money when idle?No
- Serverless
- In examsSAA · SOA · CLF
Think of it asLike a detective reconstructing a case timeline from cameras and entry logs.
When to use it
✓ Use it when
You already have an alert (GuardDuty, Security Hub) and need to dig deeper.
✗ Avoid it when
Detecting threats in the first place → GuardDuty.
Common uses
- Investigate what a leaked access key did
- Trace an unknown IP accessing EC2
- View an IAM role's behavior history
What does it cost?
- Pricing model: Charged per GB of log data ingested for analysis.
Related services
SAA-C03 study guide
Detective is covered in these study modules: