Estimating GuardDuty cost - Amazon GuardDuty
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China.

Estimating GuardDuty cost

GuardDuty RDS Protection is in preview release. Your use of the RDS Protection feature is subject to Section 2 of the Amazon Service Terms ("Betas and Previews").

You can use the GuardDuty console and API operations to estimate how much GuardDuty will cost you per month. During the 30-day free trial period, the cost estimation projects what your estimated costs will be after the trial period. If you are operating in a multiple-account environment, your GuardDuty administrator account can monitor cost metrics for all of your member accounts.

You can view cost estimation based on the following metrics:

  • Account ID – Lists the estimated cost for your account, or for your member accounts if you are operating as a GuardDuty administrator account.

  • Data source – Lists the estimated cost on the specified data source for the following GuardDuty data source types: VPC flow logs, CloudTrail management logs, CloudTrail data events for S3, DNS logs, EKS audit logs, or EBS volume data.

  • S3 buckets – Lists the estimated cost for S3 data events on a specified bucket or the most expensive buckets for accounts in your environment.


    S3 bucket statistics are only available if S3 Protection is enabled for the account. For more information, see Amazon S3 Protection in Amazon GuardDuty.

Understanding how usage costs are calculated

When you use the cost monitoring feature of GuardDuty, it is important to understand how the estimates are calculated. The estimates displayed in GuardDuty may differ slightly from those in your Billing and Cost Management console. Note the following about how GuardDuty cost estimates are calculated.

  • The GuardDuty usage estimate is for the current Region only.

  • The GuardDuty usage estimate is an average daily cost based on the past 7 to 30 days of usage.


    For newly-enabled detector IDs or data sources with fewer than seven days of usage, the cost is listed as Pending.

  • The trial estimate reflects the data sources that are currently in a trial period.

  • The GuardDuty usage estimate includes GuardDuty volume pricing discounts per Region, as detailed on the Amazon GuardDuty Pricing page, but only for individual accounts meeting the volume pricing tiers. Volume pricing discounts are not included in estimates for combined total usage between accounts within an organization. For information about combined usage volume discount pricing, see Amazon Billing: Volume Discounts.

Free preview of GuardDuty RDS Protection

GuardDuty RDS Protection is available to use at no cost during the preview release. After this feature is generally available, you will still be able to leverage the 30-day free-trial period for this feature.

Although Amazon is not currently charging for use of the GuardDuty RDS Protection preview release, you are responsible for the costs incurred by using other Amazon services in combination with this feature. These services may include Amazon Aurora, Amazon EventBridge, Amazon S3, and Amazon KMS, among other Amazon services. Standard pricing applies to these services. You are also responsible for costs incurred by using Amazon GuardDuty features that are generally available, such as Malware Protection, EKS Protection, and S3 Protection.

Review GuardDuty usage statistics (Console)

  1. Open the GuardDuty console at

    Make sure to use the GuardDuty administrator account.

  2. In the navigation pane, choose Usage.

  3. GuardDuty administrator accounts with members see a list of all managed accounts. Single accounts see a breakdown by data source.

    If you have member accounts, you can view statistics for an individual account by selecting that account in the Accounts table. If S3 protection is enabled for the selected account, the top S3 buckets by usage cost are displayed in the By data source panel.


    A green dot indicates that a free trial period is active.

Review GuardDuty usage statistics (API)

To view cost metrics, run the GetUsageStatistics API operation using the credentials of the GuardDuty administrator account. Supply the following information to run the command:

  • (Required) Specify the Regional GuardDuty detector ID of the account you want to retrieve statistics for.

  • (Required) Specify the type of statistics to retrieve: SUM_BY_ACCOUNT | SUM_BY_DATA_SOURCE | SUM_BY_RESOURCE | TOP_RESOURCES.

  • (Required) Specify at least one data source to query from the following options: FLOW_LOGS | CLOUD_TRAIL | DNS_LOGS | S3_LOGS | KUBERNETES_AUDIT_LOGS | EC2_MALWARE_SCAN.

  • (Optional) Specify a list of account IDs to retrieve usage statistics for.

You can also use the Amazon Command Line. Run the command below, replacing the example detector ID with your own, to get the sum of usage for all data sources. For single accounts, this command returns the cost over the past 30 days for your account only. If you are a GuardDuty administrator with member accounts, you see costs listed by account for all members.

aws guardduty get-usage-statistics --detector-id 12abc34d567e8fa901bc2d34e56789f0 --usage-statistic-type SUM_BY_ACCOUNT --usage-criteria '{"DataSources":["FLOW_LOGS", "CLOUD_TRAIL", "DNS_LOGS", "S3_LOGS", "KUBERNETES_AUDIT_LOGS", "EC2_MALWARE_SCAN"]}'