GuardDuty Pricing Calculator - Threat Detection & Protection Plans

S3 Protection monitors S3 data events (GetObject, PutObject, ListObjects, DeleteObject) for anomalous access patterns and potential data exfiltration. Pricing is tiered: first 500 million events at $0.80 per million, next 4.5 billion at $0.40/million, and over 5 billion at $0.20/million. This is automatically enabled for new GuardDuty accounts.

EKS Protection analyzes Kubernetes audit logs to detect threats in your EKS clusters. Tiered pricing: first 100 million events at $1.60 per million, next 100 million at $0.80/million, and over 200 million at $0.40/million. This covers API server activity, authentication attempts, and suspicious kubectl commands.

Runtime Monitoring provides deep visibility into EC2, ECS, and EKS workloads by deploying a security agent. Pricing is approximately $0.0015 per vCPU-hour monitored. This detects runtime threats like cryptocurrency mining, container escapes, and suspicious process behavior. Note: VPC Flow Log charges are excluded when the agent is deployed.

GuardDuty offers a 30-day free trial for AWS accounts that have never enabled the service. During the trial, all features are included: foundational threat detection, S3 Protection, EKS Protection, Lambda Protection, RDS Protection, Malware Protection, and Runtime Monitoring. Monitor your estimated monthly spend in the GuardDuty console during the trial.

Malware Protection scans EBS volumes and S3 objects for malware at approximately $0.03 per GB scanned. EBS scans are triggered when GuardDuty detects suspicious behavior indicating malware. S3 scanning can be enabled for buckets to scan objects at upload time. Scans are performed using agentless technology.

RDS Protection monitors Amazon RDS database login activity to identify potential threats like brute force attacks and anomalous access patterns. Pricing is approximately $0.15 per vCPU per month for monitored instances. It supports Aurora MySQL, Aurora PostgreSQL, and RDS for MySQL/PostgreSQL databases.

Lambda Protection monitors Lambda function network activity to detect suspicious behavior like communication with known malicious IP addresses or unusual data transfer patterns. Pricing is $1.00 per GB of network logs analyzed. This helps identify compromised Lambda functions or misconfigurations that could lead to data breaches.