【Guidelines】Consideration for introducing Amazon GuardDuty to Corporate Organization/System

Created date: 2025/01/22, Update date: 2025/01/22

Amazon GuardDuty is a service that monitors and threats activities in the AWS account.
In this article, we have described the summary of the Amazon GuardDuty and the points to be confirmed when considering the introduction into a company organization/system.

Table of Contents

Revision History
What is Amazon GuardDuty?
Consideration for Introduction
1. ① Are you using IDS/IPS products?
Design Considerations
1. ① Examination of Protection Functions to be Enabled
2. ② Role Assignment Arrangement

Revision History

Date	Update contents
2025/01/22	・ “GuardDuty Malware Protection for S3” “GuardDuty Runtime Monitoring” is added ・ Updated linked

What is Amazon GuardDuty?

Amazon GuardDuty (hereinafter abbreviated: GD) is a managed threat detection service that monitors activities in the AWS account and detects unauthorized actions and suspicious activities.
GD collects and analyzes AWS CloudTrail logs, Amazon VPC Flow Logs, and DNS logs to detect illegal activities.
- It is often misunderstood, but there is no need to enable CloudTrail and VPC Flow Logs to use GD.
In GD, the following 7 threat detection functions can be used optionally in addition to the basic data sources.
- GuardDuty EKS Protection
- GuardDuty Lambda Protection
- GuardDuty Malware Protection for EC2
- GuardDuty Malware Protection for S3
- GuardDuty RDS Protection
- GuardDuty S3 Protection
- GuardDuty Runtime Monitoring

It is recommended that you use a free trial first to check how much it costs because you can have a 30-day free trial.

Consideration for Introduction

① Are you using IDS/IPS products?

GD is classified as IDS/IPS (Intrusion Detection System/Intrusion Prevention System).
If you are using IDS/IPS products in an existing environment, you need to consider combining them with GD.
- IDS only makes notifications when it finds abnormal communication, but IPS can block communication in addition to notifications when it finds abnormal communication.
- IPS can provide quicker responses compared to IDS, but it also has a larger business impact.
  - This is because if the setting is incorrect, a false positive can occur, which can lead to an immediate system stop.
GD uses machine learning, so it can detect brute force attacks and suspicious API calls.
The following table organizes the types of attacks and communications that are detected/blocked by GD and Network Firewall managed rules, helping you understand their capabilities and differences.
- Reference:
  - GuardDuty finding types - Amazon GuardDuty
  - Using AWS managed rule groups in AWS Network Firewall - AWS Network Firewall

Category	Item	GuardDuty	Network Firewall
Attack	Malware	○	○
〃	DoS/DDoS	○	○
〃	Zero day (vulnerability)	○	○
〃	Phishing	○	○
〃	Brute Force	○	-
Communication	Botnet	○	○
〃	Anonymous communication (tor)	○	-
〃	Suspicious communication source/communication destination	○	○
〃	Suspicious API communication	○	-
〃	Other suspicious communication	○	○
Settings	Kubernetes setting incomplete	○	-

If you use existing IDS/IPS products or Network Firewall, the use of GD may not be necessary.

Design Considerations

① Examination of Protection Functions to be Enabled

In GD, the following 7 threat detection functions can be used optionally. Evaluate which threat detection functions should be enabled for your organization.

No	Protection	Overview	Price (Tokyo Region)
01	S3 Protection	Monitor both CloudTrail management events and data events and analyze the API operations of the Amazon S3 bucket.	1.04 USD per million events (First 500 million events/month)
02	RDS Protection	Analyze the login activity of the Amazon Aurora database.	1.33 USD per VCPU
03	Malware Protection for EC2	If a threatening activity is detected, scan the EBS attached to the Amazon EC2 instance or container workload.	0.05 USD per GB
04	Malware Protection for S3	Scan the file uploaded to the S3 bucket to detect malware.	0.60 USD per GB
05	EKS Protection	Monitor EKS audit logs and runtime to analyze applications, control planes, and events.	Audit Log: 2.48 USD/1 million events (First 100 million events/month) EKS runtime monitoring: 2.00 USD per VCPU (First 500 VCPU/month)
06	Lambda Protection	Analyze Lambda network activity logs.	1.18 USD per GB (First 500 GB/month)
07	Runtime Monitoring	Match resources such as Lambda, EC2, Fargate.	1.50 USD per VCPU (First 500 VCPU/month)

Reference
When considering enabling threat detection functions, it is important to check that the GD detection content has not been countered and detected in other designs.
The following is a list of detection result types and countermeasures/detection methods in S3 Protection.
- GuardDuty S3 Protection finding types - Amazon GuardDuty
It is basically possible to take measures/detect using the functions of other AWS services.

GuardDuty S3 detection result type	Default importance	Presence or absence of measures/detection methods
Discovery:S3/AnomalousBehavior	Low	Applicable (*1)
Discovery:S3/MaliciousIPCaller	High	Applicable (*1)
Discovery:S3/MaliciousIPCaller.Custom	High	Applicable (*1)
Discovery:S3/TorIPCaller	Medium	Applicable (*1)
Exfiltration:S3/AnomalousBehavior	High	Applicable (*1)
Exfiltration:S3/MaliciousIPCaller	High	Applicable (*1)
Impact:S3/AnomalousBehavior.Delete	High	Applicable (1,4)
Impact:S3/AnomalousBehavior.Permission	High	Applicable (1,2,*3)
Impact:S3/AnomalousBehavior.Write	Medium	Applicable (*1)
Impact:S3/MaliciousIPCaller	High	Applicable (*1)
PenTest:S3/KaliLinux	Medium	Applicable (*1)
PenTest:S3/ParrotLinux	Medium	Applicable (*1)
PenTest:S3/PentooLinux	Medium	Applicable (*1)
Policy:S3/AccountBlockPublicAccessDisabled	Low	Applicable (*2)
Policy:S3/BucketAnonymousAccessGranted	High	Applicable (2,3)
Policy:S3/BucketBlockPublicAccessDisabled	Low	Applicable (*2)
Policy:S3/BucketPublicAccessGranted	High	Applicable (*2)
Stealth:S3/ServerAccessLoggingDisabled	Low	Applicable (*2)
UnauthorizedAccess:S3/MaliciousIPCaller.Custom	High	Applicable (*1)
UnauthorizedAccess:S3/TorIPCaller	High	Applicable (*1)

*1: Deleting IAM authentication information, restrictions on the source IP, MFA device authentication
*2: Security Hub, Config
*3: Access Analyzer
*4: Prohibition of operation by SCP

② Role Assignment Arrangement

The main tasks generated during GD operation are the following four.

Initial setup of detector
Confirmation of detection results/correspondence
Filtering the detection result (tuning)
Introduction of function updates

Basically, it is the role of the foundation team to enable security-based AWS services, so the foundation team is typically responsible for “1. Initial setup of detectors” and “4. Introduction of function updates”.
“2. Confirmation of detection results/correspondence” and “3. Filtering the detection result (tuning)” are difficult to respond to unless they know the system design, so they are often handled by system staff.
Determine role assignments based on the extent of AWS service authority delegation.