Overview
Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and anomalous behavior to protect your AWS accounts, workloads, and data stored in Amazon Simple Storage Service (Amazon S3). GuardDuty prices are based on the number of analyzed AWS CloudTrail events and the volume of Amazon Virtual Private Compute (Amazon VPC) flow logs and Domain Name System (DNS) logs. These services are directly integrated with GuardDuty, which means you don’t have to enable or pay for them separately. GuardDuty also optimizes cost by applying smart filters and analyzing only a subset of logs relevant to threat detection.
AWS CloudTrail management event analysis – Amazon GuardDuty continuously analyzes CloudTrail management events. Management events (also known as “control plane”) provide information about management operations that are performed on resources in your AWS account. CloudTrail management event analysis is charged per one million events per month and is prorated.
AWS CloudTrail S3 data event analysis – Amazon GuardDuty continuously analyzes authenticated CloudTrail S3 data events, monitoring access and activity in all your Amazon S3 buckets. CloudTrail S3 data event analysis is charged per one million events per month and is prorated.
VPC flow log and DNS query log analysis – Amazon GuardDuty continuously analyzes Amazon VPC flow logs and DNS query logs. Flow log and DNS log analysis is charged per gigabyte (GB) per month. Flow log and DNS log analysis is offered with tiered volume discounts.
Free trial
In supported regions, new Amazon GuardDuty account holders can try the service free for 30 days and gain access to all features and detection tools. The GuardDuty console indicates how many days are left in the free trial as well as average daily cost (based on volume of data analyzed), which takes the guesswork out of budget planning.
Pricing by region
Pricing examples
Example 1: In your environment, in one month, Amazon GuardDuty processes 40 million AWS CloudTrail management events and 200 million CloudTrail S3 data events in the US East (N. Virginia) region. In addition, 2,000 GB of VPC flow logs and 1,000 GB of DNS query logs are processed, for a total of 3,000 GB volume of logs.
Total Charges:
40 management events x $4.00 (40 million management events, priced per million)
+ 200 Amazon S3 data events x $0.80 (200 million data events, priced per million)
+ 500 GB logs x $1.00 (first 500 GB)
+ 2,000 GB logs x $0.50 (next 2,000 GB)
+ 500 GB logs x $0.25 (last 500 GB)
Total = $1,945 per month
Example 2: In your environment, in one month, Amazon GuardDuty processes five million AWS CloudTrail management events and one billion CloudTrail S3 data events in the US East (N. Virginia) region. In addition, 200 GB of VPC flow logs and 50 GB of DNS query logs are processed, for a total of 250 GB log volume.
Total Charges:
Five management events x $4.00 (five million management events, priced per million)
+ 500 Amazon S3 data events x $0.80 (first 500 million data events, priced per million)
+ 500 Amazon S3 data events x $0.40 (next 500 million data events, priced per million)
+ 250 GB logs x $1.00 (first 500 GB)
Total = $870 per month
Additional pricing resources
Easily calculate your monthly costs with AWS
Additional resources for switching to AWS
Amazon GuardDuty is a threat detection service that provides you with an accurate and easy way to continuously monitor and protect their AWS accounts and workloads.
Try Amazon GuardDuty for 30-days at no cost. You will receive full access to GuardDuty features and its detection findings during the free trial.
Get started building with Amazon GuardDuty in the AWS Console.
