Amazon GuardDuty

Amazon GuardDuty is a threat detection service within Amazon Web Services that continuously monitors a customer’s AWS accounts and workloads for malicious activity and unauthorized behavior. The service uses artificial intelligence and machine learning, combined with threat intelligence feeds from AWS and third-party security vendors, to flag suspicious activity without requiring a customer to deploy or manage any additional security software themselves.

What data GuardDuty analyzes

By default, GuardDuty analyzes foundational data sources including AWS CloudTrail management events, which record account activity; VPC Flow Logs, which capture network traffic within a customer’s virtual network; and DNS query logs. Additional protection plans extend that monitoring to CloudTrail S3 data events, Kubernetes (EKS) audit logs, runtime events across EKS, ECS and EC2, malware scanning for EBS volumes, S3 buckets and AWS Backup, RDS login and data activity, Lambda network logs, and activity involving AI services like Bedrock and SageMaker.

How GuardDuty is priced and enabled

GuardDuty is a pay-as-you-go service, with pricing based on the volume of logs and events it analyzes and varying by AWS region. Every new AWS account receives a free 30-day trial in each region. Turning GuardDuty on activates its default detection capabilities, which AWS does not allow customers to disable, while the additional, more specialized protection plans can be turned on or off individually depending on which workloads a customer wants covered.

GuardDuty’s newer AI-powered features

AWS has added AI-powered investigation capabilities to GuardDuty, currently available in preview, which aim to deliver disposition assessments, essentially an automated judgment on whether a flagged event is a genuine threat, within minutes, integrating with other AWS security tools like Amazon Detective, Security Hub and EventBridge. A separate AI Protection feature covers risks specific to AI workloads, such as anomalous model invocations, cost-harvesting attacks, and prompt injection attempts against AI services running on AWS.

Why cloud threat detection services like GuardDuty matter

As companies have moved more infrastructure into cloud platforms like AWS, detecting compromised credentials, unusual network traffic, or malware within that cloud environment has become as important as traditional on-premises network security monitoring. Because a cloud environment generates a large volume of logs and activity across many services, a managed detection service like GuardDuty can surface threats that would be difficult for a security team to find by manually reviewing logs across dozens of different AWS services.

GuardDuty within the broader AWS security ecosystem

GuardDuty is one part of a broader suite of AWS security services, working alongside tools like AWS Security Hub, which aggregates findings across multiple security services, and Amazon Detective, which helps investigate the root cause of a flagged security finding in more depth. Rather than functioning as a standalone product, GuardDuty is designed to feed its findings into this wider AWS security tooling ecosystem, letting a security team move from detection to investigation to response within connected AWS services.

FAQs

What does Amazon GuardDuty monitor by default? By default, GuardDuty analyzes AWS CloudTrail management events, VPC Flow Logs and DNS query logs to detect suspicious activity across a customer’s AWS accounts.

How is GuardDuty priced? GuardDuty is a pay-as-you-go service priced based on the volume of logs and events analyzed, varying by AWS region, with a free 30-day trial for new accounts.

Can GuardDuty’s default detection be turned off? No; AWS does not allow customers to disable GuardDuty’s default detection capabilities once the service is activated, though additional protection plans can be turned on or off individually.

Does GuardDuty use artificial intelligence? Yes; GuardDuty uses AI and machine learning combined with threat intelligence from AWS and third-party vendors, and AWS has added AI-powered investigation features currently available in preview.

Does every AWS customer need GuardDuty? AWS positions GuardDuty as broadly useful for any customer running workloads on AWS, since its foundational detection capabilities, based on CloudTrail, VPC Flow Logs and DNS query logs, apply to common account-level risks regardless of what specific workloads a customer runs.

Editorially reviewed by Specialty Digest Editorial TeamLast reviewed November 9, 2026Researched and drafted with AI assistanceReport an issue