Amazon GuardDuty review
Broad AWS workload protection with runtime, malware, and automated response capabilities.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Amazon GuardDuty is a fully managed AWS threat detection service for organizations protecting cloud accounts, workloads, and data. It monitors AWS activity across services including EC2, EKS, ECS on Fargate, Lambda, S3, RDS, and Amazon Bedrock-related AI workloads. The service generates security findings with severity and resource details, making it suited to teams that want broad AWS visibility through web and API access rather than a narrow control for one workload type.
Coverage is organized around protection plans and AWS data sources. Foundational threat detection analyzes CloudTrail management events, VPC Flow Logs, and DNS query logs, while S3 Protection, EKS Protection, RDS Protection, and Lambda Protection focus on service-specific activity. Runtime Monitoring examines operating-system, networking, and file events from EKS, EC2, and ECS on Fargate. Malware Protection scans supported resources or objects, and AI Protection analyzes CloudTrail data events from Bedrock, Bedrock AgentCore, and SageMaker AI. This breadth makes GuardDuty a strong fit for mixed AWS environments with containers, Kubernetes, serverless functions, databases, and storage.
Response and ecosystem fit are central to the service. GuardDuty integrates with CloudTrail, VPC Flow Logs, Route 53 Resolver DNS query logs, EventBridge, SNS, Security Hub CSPM, Detective, and Systems Manager. EventBridge notifications can feed AWS Lambda processing, SNS alerts, Systems Manager automation, and targets including EC2, Kinesis, ECS, Step Functions, and Run Command. According to the pricing details, GuardDuty is paid and uses pay-as-you-go billing based on analyzed logs, events, workloads, or data; a 30-day trial is available, but it is not a permanent free plan. AWS-focused teams should consider it; organizations needing multi-cloud coverage should choose another platform.
Amazon GuardDuty pros and cons
- Where it wins
- Covers EC2, EKS, ECS, Fargate, Lambda, S3, RDS, and AWS accounts
- Adds runtime monitoring, malware scanning, and AI-powered detection
- Supports EventBridge workflows and multi-account AWS Organizations administration
- Where it doesn't
- Supports AWS as its cloud platform
- No permanent free plan
- Pay-as-you-go pricing varies by data source and AWS Region
Amazon GuardDuty fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update