Amazon GuardDuty
Threat detection
Continuously analyzes CloudTrail, VPC Flow Logs, and DNS logs (and optionally S3, EKS, RDS, Lambda, malware) with threat intelligence and machine learning to detect suspicious behavior such as crypto mining, leaked keys, and access from malicious IPs.
- Cost$$ Medium
- Difficulty●●●●●
- Costs money when idle?No
- Serverless
- In examsCLF · SAA · SOA
Think of it asLike an AI security camera that sounds the alarm when it spots a stranger lurking.
When to use it
✓ Use it when
Almost every account should enable it to detect intrusions.
✗ Avoid it when
Rule-based blocking of web attacks → WAF; scanning for software vulnerabilities → Inspector.
Common uses
- Detect EC2 mining cryptocurrency
- Alert on credentials used from unknown IPs
- Malware scanning on EBS/S3
What does it cost?
- Pricing model: Charged by the volume of CloudTrail events and GB of logs (VPC Flow, DNS) analyzed, plus a fee for each additional protection plan enabled.
High-traffic accounts or enabling many protection plans can raise costs significantly — check the estimate in the console after the 30-day trial.
When the question says detect threats, leaked keys, or instances talking to malicious IPs without installing agents, choose GuardDuty; for software vulnerability scanning, Inspector; for finding PII in S3, Macie; for blocking web attacks, WAF.
Frequently asked questions
How is GuardDuty different from Inspector and Macie?
GuardDuty detects suspicious activity as it happens (leaked keys, crypto mining, connections to bad IPs). Inspector scans EC2, container images and Lambda for software vulnerabilities and network exposure. Macie finds sensitive data such as personal information in S3. The three complement each other rather than replace each other.
Do I need to install agents or turn on logs for GuardDuty?
For the core sources, no: GuardDuty reads CloudTrail, VPC Flow Logs and DNS logs independently, so you do not have to enable or store those logs for it, and it does not affect performance. The extended protections (S3, EKS, RDS, Lambda, malware) are turned on separately as needed.
Does GuardDuty block attacks automatically?
No, it only detects and creates findings. To react automatically, send findings to EventBridge and trigger Lambda or SSM to isolate an instance or revoke keys. For many accounts, designate a delegated administrator in Organizations to enable it and view findings centrally; it works per Region.
Related services
SAA-C03 study guide
GuardDuty is covered in these study modules: