【Guidelines】Consideration for introducing Amazon GuardDuty to Corporate Organization/System

Created date: 2025/01/22, Update date: 2025/01/22

Amazon GuardDuty is a service that monitors and threats activities in the AWS account.
In this article, we have described the summary of the Amazon GuardDuty and the points to be confirmed when considering the introduction into a company organization/system.

Table of Contents

Revision History
What is Amazon GuardDuty?
Considerations for Adoption
1. ① Are you using IDS/IPS products?
Design Considerations
1. ① Evaluating Which Protection Features to Enable
2. ② Role Assignment

Revision History

Date	Update contents
2025/01/22	・ Added “GuardDuty Malware Protection for S3” and “GuardDuty Runtime Monitoring” ・ Updated links

What is Amazon GuardDuty?

Amazon GuardDuty (hereafter referred to as GD) is a managed threat detection service that monitors activity in your AWS account and detects unauthorized actions and suspicious behavior.
GD collects and analyzes AWS CloudTrail logs, Amazon VPC Flow Logs, and DNS logs to identify malicious activity.
- A common misconception is that you must enable CloudTrail and VPC Flow Logs to use GD, but this is not required.
GD offers the following seven optional threat detection features in addition to its basic data sources:
- GuardDuty EKS Protection
- GuardDuty Lambda Protection
- GuardDuty Malware Protection for EC2
- GuardDuty Malware Protection for S3
- GuardDuty RDS Protection
- GuardDuty S3 Protection
- GuardDuty Runtime Monitoring

It is recommended to take advantage of the 30-day free trial to estimate costs before fully enabling GuardDuty.

Considerations for Adoption

① Are you using IDS/IPS products?

GD is classified as an IDS/IPS (Intrusion Detection System/Intrusion Prevention System).
If you already use IDS/IPS products in your environment, consider how to integrate them with GD.
- IDS only notifies you of abnormal traffic, while IPS can also block it.
- IPS enables faster responses than IDS, but can have a greater business impact.
  - Incorrect IPS settings can cause false positives, potentially leading to system outages.
GD uses machine learning to detect brute force attacks and suspicious API calls.
The table below summarizes the types of attacks and communications detected or blocked by GD and Network Firewall managed rules, helping you understand their capabilities and differences.
- References:
  - GuardDuty finding types - Amazon GuardDuty
  - Using AWS managed rule groups in AWS Network Firewall - AWS Network Firewall

Category	Item	GuardDuty	Network Firewall
Attack	Malware	○	○
〃	DoS/DDoS	○	○
〃	Zero day (vulnerability)	○	○
〃	Phishing	○	○
〃	Brute Force	○	-
Communication	Botnet	○	○
〃	Anonymous communication (Tor)	○	-
〃	Suspicious communication source/destination	○	○
〃	Suspicious API communication	○	-
〃	Other suspicious communication	○	○
Settings	Incomplete Kubernetes configuration	○	-

If you already use IDS/IPS products or Network Firewall, you may not need to use GD.

Design Considerations

① Evaluating Which Protection Features to Enable

GD offers the following seven optional threat detection features. Evaluate which features are appropriate for your organization.

No	Protection	Overview	Price (Tokyo Region)
01	S3 Protection	Monitors both CloudTrail management events and data events, and analyzes API operations on Amazon S3 buckets.	$1.04 per million events (First 500 million events/month)
02	RDS Protection	Analyzes login activity for Amazon Aurora databases.	$1.33 per vCPU
03	Malware Protection for EC2	Scans EBS volumes attached to Amazon EC2 instances or container workloads when a threat is detected.	$0.05 per GB
04	Malware Protection for S3	Scans files uploaded to S3 buckets for malware.	$0.60 per GB
05	EKS Protection	Monitors EKS audit logs and runtime to analyze applications, control planes, and events.	Audit Log: $2.48 per million events (First 100 million events/month) EKS runtime monitoring: $2.00 per vCPU (First 500 vCPU/month)
06	Lambda Protection	Analyzes Lambda network activity logs.	$1.18 per GB (First 500 GB/month)
07	Runtime Monitoring	Monitors resources such as Lambda, EC2, and Fargate.	$1.50 per vCPU (First 500 vCPU/month)

References:
When considering which threat detection features to enable, make sure that the threats detected by GD are not already addressed by other designs.
The following is a list of S3 Protection finding types and their corresponding countermeasures or detection methods.
- GuardDuty S3 Protection finding types - Amazon GuardDuty
In most cases, you can address or detect these findings using other AWS services.

GuardDuty S3 finding type	Default severity	Countermeasure or detection method present?
Discovery:S3/AnomalousBehavior	Low	Yes (*1)
Discovery:S3/MaliciousIPCaller	High	Yes (*1)
Discovery:S3/MaliciousIPCaller.Custom	High	Yes (*1)
Discovery:S3/TorIPCaller	Medium	Yes (*1)
Exfiltration:S3/AnomalousBehavior	High	Yes (*1)
Exfiltration:S3/MaliciousIPCaller	High	Yes (*1)
Impact:S3/AnomalousBehavior.Delete	High	Yes ( 1, 4)
Impact:S3/AnomalousBehavior.Permission	High	Yes ( 1, 2, *3)
Impact:S3/AnomalousBehavior.Write	Medium	Yes (*1)
Impact:S3/MaliciousIPCaller	High	Yes (*1)
PenTest:S3/KaliLinux	Medium	Yes (*1)
PenTest:S3/ParrotLinux	Medium	Yes (*1)
PenTest:S3/PentooLinux	Medium	Yes (*1)
Policy:S3/AccountBlockPublicAccessDisabled	Low	Yes (*2)
Policy:S3/BucketAnonymousAccessGranted	High	Yes ( 2, 3)
Policy:S3/BucketBlockPublicAccessDisabled	Low	Yes (*2)
Policy:S3/BucketPublicAccessGranted	High	Yes (*2)
Stealth:S3/ServerAccessLoggingDisabled	Low	Yes (*2)
UnauthorizedAccess:S3/MaliciousIPCaller.Custom	High	Yes (*1)
UnauthorizedAccess:S3/TorIPCaller	High	Yes (*1)

*1: Delete unused IAM credentials, restrict source IPs, require MFA device authentication
*2: Security Hub, AWS Config
*3: Access Analyzer
*4: Restrict operations using SCP

② Role Assignment

The main tasks involved in operating GD are as follows:

Initial setup of detectors
Reviewing and responding to findings
Tuning (filtering) findings
Implementing feature updates

Typically, the platform team is responsible for enabling security-related AWS services, so they usually handle “1. Initial setup of detectors” and “4. Implementing feature updates.”
“2. Reviewing and responding to findings” and “3. Tuning findings” require knowledge of system design, so these are often handled by system administrators.
Assign roles based on how AWS service permissions are delegated in your organization.