AmazonGuardDuty

guardduty

PaidEventsAnalyzed

Amazon GuardDuty has foundational threat monitoring pricing that it prices based upon the number of events analyzed in AWS CloudTrail. This billing code represents the costs associated with the number of events analyzed which is priced per one million events per month.

PaidEventsAnalyzed-Bytes

Amazon GuardDuty has foundational threat monitoring pricing that it prices based upon the Bytes analyzed from VPC flow logs. This billing code represents the costs associated with the ingestion and analysis of this data and is priced per GB per month with a tier pricing model. List pricing starts for the first 500GB / month analyzed. The tiers are 0-500GB, 500GB - 2500GB, 2500GB - 10,000 GB and over 10,000 GB per month.

PaidS3DataEventsAnalyzed

Amazon GuardDuty monitors threats against your S3 resources by analyzing CloudTrail management events and CloudTrail S3 data events. When the GuardDuty S3 Protection feature is turned on, GuardDuty continuously analyzes authenticated CloudTrail S3 data events, monitoring access and activity in your S3 buckets. CloudTrail S3 data event analysis is charged per 1 million events per month, is prorated, and is discounted with volume.

PaidKubernetesAuditLogsAnalyzed

This is the charge associated with Amazon GuardDuty's audit logging for Kubernetes. When EKS Audit Log Monitoring is activated, GuardDuty continuously analyzes EKS audit logs and optimizes costs by processing only events that are used for security analysis. EKS audit log analysis is charged per 1 million audit logs per month, is prorated, and is discounted with volume. Please note that this is a separate and distinct billing code than GuardDuty for Runtime Monitoring of EC2 nodes within an EKS cluster.

PaidLambdaNetworkLogsAnalyzed-Bytes

Amazon GuardDuty for Lambda offers protection for continuously monitoring network activity of logs generated from the execution of AWS Lambda functions to detect threats to Lambda, such as functions maliciously repurposed for unauthorized cryptocurrency mining, or compromised Lambda functions that are communicating with known threat actor servers. AWS charges for the amount of network activity scanned and has a tiered pricing model.

FreeEventsAnalyzed

Amazon GuardDuty has foundational threat monitoring that analyzes events from AWS CloudTrail. The first 30 days of usage is free and this billing code represents the corresponding free tier usage. Once you roll off of the first 30 days of usage, you will be charged per millions events monitored per month.

PaidRDSvCPUMonitored

GuardDuty RDS protection will profile login activity for RDS instances for potential threats. Oddly, Amazon charges for RDS GuardDuty on a per vCPU per month fee. This specific billing code is the per vCPU charge for GuardDuty RDS protection. Please note that as you scale up the size of your RDS database with more vCPUs, you will incur more correponding costs from Guard Duty.

PaidFargatevCPUMonitored

Amazon GuardDuty offers Runtime Monitoring for Fargate. When GuardDuty Runtime Monitoring is activated for a workload, GuardDuty begins collecting and analyzing runtime events for suspicious or potentially malicious activity. GuardDuty Runtime Monitoring pricing is based on the number and size of protected workloads, measured in vCPUs. Fargate Runtime Monitoring also has a tiered pricing model based upon the total number of vCPUs monitored. There is a rate for the first 500 vCPUs monitored, the next 4,500 vCPUs monitored and finally a rate beyond 5,000 vCPUs monitored.

FreeEC2vCPUMonitored

Amazon GuardDuty offers Runtime Monitoring for EC2 that has an associated free trial. This billing code represents the free trial period which exists for the first 30 days of usage in an acocunt. Once you roll off of the free trial, you'll have to pay a rate per vCPU monitored per month.

PaidEKSvCPUMonitored

Amazon GuardDuty offers Runtime Monitoring for EKS. When GuardDuty Runtime Monitoring is activated for a workload, GuardDuty begins collecting and analyzing runtime events for suspicious or potentially malicious activity. GuardDuty Runtime Monitoring pricing is based on the number and size of protected workloads, measured in vCPUs. EKS Runtime Monitoring also has a tiered pricing model based upon the total number of vCPUs monitored. There is a rate for the first 500 vCPUs monitored, the next 4,500 vCPUs monitored and finally a rate beyond 5,000 vCPUs monitored.

PaidRDSACUMonitored

GuardDuty RDS protection will profile login activity for RDS instances for potential threats. Oddly, Amazon charges for RDS GuardDuty on a per ACU (which stands for Aurora Serverless Compute Unit) per month fee. This specific billing code is the per ACU charge for GuardDuty RDS protection for Aurora Serverless on RDS. Please note that as you scale up the size of your Aurora cluster with more ACUs, you will incur more correponding costs from Guard Duty.

FreeS3DataEventsAnalyzed

Amazon GuardDuty can monitor network events against your S3 buckets and has an associated 30 day free trial. This billing code represents the usage of that 30 day free trial and once you roll off of the 30 day period, you'll begin to be charged a rate per million events which will appear as a separate, distinct billing code.

FreeRDSvCPUMonitored

This is the free tier billing code for Amazon's Guard Duty product for RDS. AWS offers a 30 day trial for AWS Guard Duty for RDS. Once you roll off of 30 days of free trial usage, you will begin to incur a charge per vCPU on your monitored RDS instances.

FreeLambdaNetworkLogsAnalyzed-Bytes

Amazon GuardDuty offers protection for monitoring network activity associated with Lambda functions. This billing code represents the 30 day free trial. Once your 30 days are up, you'll be charged for the associated amount of network activity scanned by Amazon GuardDuty to monitored Lambda functions.

PaidEC2vCPUMonitored

Amazon GuardDuty offers Runtime Monitoring for EC2. When GuardDuty Runtime Monitoring is activated for a workload, GuardDuty begins collecting and analyzing runtime events for suspicious or potentially malicious activity. GuardDuty Runtime Monitoring pricing is based on the number and size of protected workloads, measured in vCPUs. EC2 Runtime Monitoring also has a tiered pricing model based upon the total number of vCPUs monitored. There is a rate for the first 500 vCPUs monitored, the next 4,500 vCPUs monitored and finally a rate beyond 5,000 vCPUs monitored.

MalwareProtectionS3ScanRequest

GuardDuty offers fully managed malware scanning for newly uploaded objects in your selected Amazon S3 buckets. S3 object scanning costs are based on the GB volume of the objects scanned and number of objects evaluated per month. Amazon S3 APIs are required for Malware Protection for S3 and are priced separately. This billing code represents the fee assciated with the number of objects evaluted per month which has a rate per 1,000 objects scanned.

MalwareProtectionS3DataScanned

GuardDuty offers fully managed malware scanning for newly uploaded objects in your selected Amazon S3 buckets. S3 object scanning costs are based on the GB volume of the objects scanned and number of objects evaluated per month. Amazon S3 APIs are required for Malware Protection for S3 and are priced separately. This billing code represents the fee assciated with the network transit which is priced per GB / month.

PaidMalwareProtectionEBSDataScanned

Amazon GuardDuty offers malware protection as a paid service for EBS Volumes. When enabled, Amazon will create a replica of your EBS volume which is scanned for possible malware. The charge for GuardDuty Malware Protection is based on the total and prorated GB volume of Amazon EBS data scanned each month. Note that in order to have this feature enabled, it's required that you use EBS snapshots which incur additional, separate charges beyond this distinct billing code. This feature is billed per GB per month.

FreeEventsAnalyzed-Bytes

Amazon GuardDuty has foundational threat monitoring that analyzes network traffic from VPC Flow Logs. The first 30 days of usage is free and this billing code represents the corresponding free tier usage. Once you roll off of the first 30 days of usage, you will be charged per GB per month.

FreeKubernetesAuditLogsAnalyzed

This is the free tier associated with Amazon GuardDuty's audit logging for Kubernetes that exists for a 30 day duration. Once your 30 days it up, you'll begin to be charged per million events per month which will appear as a separate billing code.

FreeEKSvCPUMonitored

Amazon GuardDuty offers Runtime Monitoring for EKS that has an associated free trial. This billing code represents the free trial period which exists for the first 30 days of usage in an acocunt. Once you roll off of the free trial, you'll have to pay a rate per vCPU monitored per month associated with the pods monitored.

FreeFargatevCPUMonitored

Amazon GuardDuty offers Runtime Monitoring for Fargate that has an associated free trial. This billing code represents the free trial period which exists for the first 30 days of usage in an acocunt. Once you roll off of the free trial, you'll have to pay a rate per vCPU monitored per month.

FreeRDSACUMonitored

This is the free tier billing code for Amazon's Guard Duty product for RDS Aurora Serverless. AWS offers a 30 day trial for AWS Guard Duty for Aurora Serverless. Once you roll off of 30 days of free trial usage, you will begin to incur a charge per ACU (Aurora Compute Unit) on your monitored RDS Aurora Clusters.

PaidOnDemandEBSVolumeDataScanned

Amazon GuardDuty offers malware protection as a paid service for EBS Volumes. When enabled, Amazon will create a replica of your EBS volume which is scanned for possible malware. The charge for GuardDuty Malware Protection is based on the total and prorated GB volume of Amazon EBS data scanned each month. Note that in order to have this feature enabled, it's required that you use EBS snapshots which incur additional, separate charges beyond this distinct billing code. This feature is billed per GB per month. Note that this particular billing code is the on-demand billing code for EBS volume protection which means it is likely being triggered manually by you or someone at your organization vs the automated GuardDuty service which would monitor on your behalf and show up as a distinct, separate billing code.

FreeMalwareProtectionEBSDataScanned

This is the free tier for Amazon's GuardDuty service which charges per GB per month of scanned data.