Amazon GuardDuty
Amazon GuardDuty: Broad AWS workload protection with runtime, malware, and automated response capabilities. Ranked #13 of 23 in Cloud Workload Protection Platforms by our editors (7.8/10); pricing: 30-day trial; best for AWS-native workload protection.
At a glance
- Editor score7.8 / 10
- Pricing30-day trial
- Best forAWS-native workload protection
- Free planNo
- Serverless protectionYes
- Facts checked20 Sep 2026
Where it wins
- Covers EC2, EKS, ECS, Fargate, Lambda, S3, RDS, and AWS accounts
- Adds runtime monitoring, malware scanning, and AI-powered detection
- Supports EventBridge workflows and multi-account AWS Organizations administration
Where it doesn't
- Supports AWS as its cloud platform
- No permanent free plan
- Pay-as-you-go pricing varies by data source and AWS Region
Our verdict on Amazon GuardDuty
Amazon GuardDuty is a fully managed AWS threat detection service for organizations protecting cloud accounts, workloads, and data. It monitors AWS activity across services including EC2, EKS, ECS on Fargate, Lambda, S3, RDS, and Amazon Bedrock-related AI workloads. The service generates security findings with severity and resource details, making it suited to teams that want broad AWS visibility through web and API access rather than a narrow control for one workload type.
Coverage is organized around protection plans and AWS data sources. Foundational threat detection analyzes CloudTrail management events, VPC Flow Logs, and DNS query logs, while S3 Protection, EKS Protection, RDS Protection, and Lambda Protection focus on service-specific activity. Runtime Monitoring examines operating-system, networking, and file events from EKS, EC2, and ECS on Fargate. Malware Protection scans supported resources or objects, and AI Protection analyzes CloudTrail data events from Bedrock, Bedrock AgentCore, and SageMaker AI. This breadth makes GuardDuty a strong fit for mixed AWS environments with containers, Kubernetes, serverless functions, databases, and storage.
Response and ecosystem fit are central to the service. GuardDuty integrates with CloudTrail, VPC Flow Logs, Route 53 Resolver DNS query logs, EventBridge, SNS, Security Hub CSPM, Detective, and Systems Manager. EventBridge notifications can feed AWS Lambda processing, SNS alerts, Systems Manager automation, and targets including EC2, Kinesis, ECS, Step Functions, and Run Command. According to the pricing details, GuardDuty is paid and uses pay-as-you-go billing based on analyzed logs, events, workloads, or data; a 30-day trial is available, but it is not a permanent free plan. AWS-focused teams should consider it; organizations needing multi-cloud coverage should choose another platform.
Your product? Our editors can test Amazon GuardDuty in depth and publish a review, labelled as paid · from $149/mo →
Amazon GuardDuty pricing
All 9 Amazon GuardDuty plans and prices →
Amazon GuardDuty fact sheet
| Free plan | No |
|---|---|
| Paid from | Not verified |
| Container protection | Yes |
| Serverless protection | Yes |
| Kubernetes protection | Yes |
| Deployment model | Hybrid |
| Response actions | EventBridge notifications; AWS Lambda processing; Amazon SNS alerts; EC2 Systems Manager automation; EC2, Kinesis, ECS, Step Functions, and Run Command targets |
| Supported host OS | Bottlerocket; Ubuntu; Amazon Linux 2; Amazon Linux 2023; Red Hat 9.4; Fedora 34; Fedora 40; Fedora 41; CentOS Stream 9 |
| Cloud platforms | AWS |
| Free trial | 30 days |
| Deployment | Cloud |
| Platforms | Web |
| Support | Docs |
| Built for | Small business, Mid-market, Enterprise (editorial estimate) |
| Integrations | 15 integrations: AWS CloudTrail, Amazon VPC Flow Logs, Amazon Route 53 Resolver DNS query logs, Amazon EKS, Amazon EC2, Amazon ECS … See all → |
| Pricing | 30-day trial (source) |
| Website | aws.amazon.com |
| Facts checked | 20 Sep 2026 |
Amazon GuardDuty integrations
Amazon GuardDuty lists 15 integrations on its own site.
- AWS CloudTrail
- Amazon VPC Flow Logs
- Amazon Route 53 Resolver DNS query logs
- Amazon EKS
- Amazon EC2
- Amazon ECS
- AWS Fargate
- AWS Lambda
- Amazon S3
- Amazon RDS
- Amazon EventBridge
- Amazon SNS
- AWS Security Hub CSPM
- Amazon Detective
- AWS Systems Manager
See all Amazon GuardDuty integrations →
Alternatives to Amazon GuardDuty
- Qualys TotalCloudBroad workload, container, Kubernetes, and serverless coverage for multi-cloud security teams.9.4
- CrowdStrike Falcon Cloud SecurityBroad cloud posture, runtime, container, Kubernetes, and detection coverage for enterprise teams.9.3
- Aqua SecurityDeep container and Kubernetes protection for teams securing workloads across development and production.9.0
See all Amazon GuardDuty alternatives →
Also Ranked In
Amazon GuardDuty is ranked in 3 of our directories.
Used Amazon GuardDuty? Be the first to review it
The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used Amazon GuardDuty for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.
Write a reviewTwo minutes · verified accounts only · read by an editor before it appears
Featured on iTechGuides
Amazon GuardDuty is listed in our Cloud Workload Protection Platforms directory. Add the badge to your site — it links back to this page.
<a href="https://www.itechguides.com/products/amazon-guardduty/"><img src="https://www.itechguides.com/best/badge/amazon-guardduty.svg" alt="Featured on iTechGuides" width="230" height="46"></a>
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update