Amazon GuardDuty

Service that detects suspicious operations and signs of attack in AWS environments.

Amazon GuardDuty is a threat detection service that identifies suspicious activity against AWS accounts and workloads.

• Detecting suspicious API operations
• Detecting suspected compromises
• Security monitoring

• A threat detection service
• Can analyze sources such as CloudTrail and VPC Flow Logs
• Serves a different role than Inspector

• Prepare notification and response flows for detections
• Aggregate findings via Security Hub
• For personal MVPs, balance cost against benefit

Amazon GuardDuty is a managed threat detection service that continuously detects suspicious activities and known attack patterns within AWS environments. It ingests AWS CloudTrail event logs, Amazon VPC Flow Logs, DNS query logs, Amazon S3 data events, and Amazon EKS audit logs as analysis targets, and uses machine learning and threat intelligence to perform anomaly detection. Users can start using it simply by enabling it from the console, without installing agents or configuring individual log collection. Detection results are notified as "Findings" with severity (Low / Medium / High) attached and can be linked via Amazon EventBridge to SNS notifications, automated Lambda responses, and aggregation in Security Hub. Representative detection examples include suspicious API calls via Tor, communication patterns suggestive of cryptocurrency mining, abnormal operations by compromised credentials, and access from unexpected regions. In the exam context, the question is asked in the form of "which service continuously detects signs of suspicious operations or attacks in the AWS environment?" and GuardDuty is the answer. Because its role is easily confused with Inspector (vulnerability scanning), Macie (sensitive data detection in S3), and Security Hub (aggregation of multiple security services), the differences in detection targets need to be organized and memorized. Pricing is usage-based according to the volume of analyzed data, and adoption is typically judged at the timing of commercialization or increased traffic.

• What is Amazon GuardDuty (AWS Official Documentation)
• Amazon GuardDuty (AWS Official)

Last updated: 2026-06-07