Amazon GuardDuty pricing calculator
Threat Detection & Protection Plans. Estimate your costs using AWS list prices.
Estimates from AWS list prices, not an AWS quote. Discounts, taxes and credit terms may affect your bill.
01 · How Amazon GuardDuty pricing works
What you pay for
- Foundational: $4 per million CloudTrail management events; VPC Flow Logs and DNS logs tiered per GB ($1.00 first 500 GB, down to $0.15).
- S3 Protection per million S3 data events (tiered from $0.80); EKS Protection per million audit events (from $1.60).
- Runtime Monitoring per vCPU-month; Malware Protection per GB scanned; RDS and Lambda protection per vCPU-hour or GB.
Common cost traps
- Busy NAT or high-traffic VPCs produce large flow-log volumes even though GuardDuty reads them directly.
- S3 Protection bills every data event on monitored buckets, including data lakes with billions of GETs.
- Enabling all protection plans organization-wide multiplies cost across accounts and Regions.
Ways to reduce cost
- Review the usage page at the end of the free trial before keeping every plan.
- Enable S3 Protection where data sensitivity justifies it.
- Consider Security Hub threat analytics pricing if you also use Security Hub Essentials.
Free Tier & account eligibility
Free Tier depends on account age. Accounts created on or after 15 July 2025 get a $100 sign-up credit plus up to $100 more for completing onboarding activities; on the Free plan these last 6 months (or until used up), on the Paid plan unused Free Tier credits stay usable for 12 months from sign-up. Accounts created before 15 July 2025 keep the legacy Free Tier (12-month offers plus always-free offers). Always-free offers apply on both plans. GuardDuty has a 30-day free trial per account and Region (including most protection plans). No always-free allowance; afterwards new-plan accounts can pay from Free Tier credits.
02 · AWS credits & runway
Do credits cover Amazon GuardDuty?
GuardDuty foundational analysis and protection plans (S3, EKS, Runtime, Malware, RDS, Lambda) are eligible usage and are offset by credits. General rules: credits only offset charges from the billing cycle in which they were applied onward (never past bills), they apply only to the services listed on the credit in Billing and Cost Management > Credits, they expire on the date shown there, and accounts on the AWS Free plan cannot receive Activate credits until they upgrade to the Paid plan.
Check my creditsExcluded charges & conditions
- Upfront payments for Savings Plans and Reserved Instances (All Upfront, and the upfront part of Partial Upfront). The recurring hourly fee of a No Upfront commitment is billed as normal usage and can be offset.
- AWS Marketplace charges (Activate credits make an exception for third-party foundation models used through Amazon Bedrock).
- AWS Enterprise Support, Enterprise On-Ramp, Unified Operations, resold support and partner-led support.
- Amazon Route 53 domain name registration and transfer fees.
- Taxes (sales, use, VAT and similar), AWS Professional Services, Training and Certification, Mechanical Turk, AWS Managed Services, and any use for cryptocurrency mining.
Illustrative credit runway
Single-service examples from the supplied data, not your calculator result. Months = credit amount ÷ monthly cost, before credit expiry. Credits can expire before these theoretical months are used; coverage and other AWS services can shorten runway.
| Usage profile | Monthly estimate | $10,000 | $25,000 | $100,000 |
|---|---|---|---|---|
| Small | $70.00 | 142.9 mo. | 357.1 mo. | 1,428.6 mo. |
| Medium | $1,110.00 | 9.0 mo. | 22.5 mo. | 90.1 mo. |
| Large | $5,435.00 | 1.8 mo. | 4.6 mo. | 18.4 mo. |
Small profile assumptions
5 M CloudTrail management events, 50 GB VPC Flow/DNS logs | CloudTrail management events: 5 million x $4 = $20.00; VPC Flow/DNS logs: 50 GB tiered (50 @ $1) = $50.00 | Total ~$70.00/month, us-east-1 on-demand list prices, before Free Tier, taxes and support.
Medium profile assumptions
30 M events, 1 TB flow logs, 200 M S3 data events, 50 M EKS audit events | CloudTrail management events: 30 million x $4 = $120.00; VPC Flow/DNS logs: 1,000 GB tiered (500 @ $1; 500 @ $0.5) = $750.00; S3 data events: 200 million events tiered (200 @ $0.8) = $160.00; EKS audit logs: 50 million events tiered (50 @ $1.6) = $80.00 | Total ~$1,110.00/month, us-east-1 on-demand list prices, before Free Tier, taxes and support.
Large profile assumptions
200 M events, 10 TB flow logs, 2 B S3 data events, 300 M EKS audit events | CloudTrail management events: 200 million x $4 = $800.00; VPC Flow/DNS logs: 10,000 GB tiered (500 @ $1; 2,000 @ $0.5; 7,500 @ $0.25) = $3,375.00; S3 data events: 2,000 million events tiered (500 @ $0.8; 1,500 @ $0.4) = $1,000.00; EKS audit logs: 300 million events tiered (100 @ $1.6; 100 @ $0.8; 100 @ $0.2) = $260.00 | Total ~$5,435.00/month, us-east-1 on-demand list prices, before Free Tier, taxes and support.
04 · Questions
Amazon GuardDuty pricing FAQ
Is there a free trial?
Yes, 30 days per account per Region, after which usage is billed.
What drives GuardDuty cost?
CloudTrail event volume, VPC Flow/DNS log volume and S3 data events on monitored buckets.
Do I need to enable VPC Flow Logs?
No. GuardDuty reads flow logs independently and you are not billed for flow log delivery for that purpose.
Do credits cover GuardDuty?
Yes, it is eligible usage.
05 · Sources & estimate notes
Content pack dated 2026-10-19. Calculator rates remain their existing snapshots; this content update is not a price refresh.
Verification notes
- Runway prices come from the calculator repository snapshot rate card guardduty (no AWS Price List mapping in the build). Confirm the main unit prices on https://aws.amazon.com/guardduty/pricing/ before publishing.