View a markdown version of this page

How the security agent connects to GuardDuty - Amazon GuardDuty
Amazon VPC endpoint connectivityPrerequisitesConsiderationsRelated topics
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

How the security agent connects to GuardDuty

The Runtime Monitoring security agent delivers runtime events to GuardDuty through an Amazon VPC endpoint. The data stays within the Amazon network. There is no additional cost for GuardDuty connectivity.

Amazon VPC endpoint connectivity

The agent connects to the GuardDuty backend through an Amazon VPC endpoint. It resolves and connects to the endpoint's private DNS name. For a non-FIPS endpoint, this is guardduty-data.us-east-1.amazonaws.com. Replace us-east-1 with your Amazon Region.

The resource must have a valid network path to an active guardduty-data Amazon VPC endpoint. GuardDuty selects the subnet based on IP availability, so for advanced network topologies, validate that a valid network path exists.

Prerequisites

For prerequisites, see Prerequisites to enabling Runtime Monitoring.

Considerations

  • Automated agent configuration – GuardDuty establishes connectivity automatically. If you manage the agent manually, you need to create an Amazon VPC endpoint for the agent to connect through.

  • All VPCs – With automated agent configuration, GuardDuty sets up connectivity across all your VPCs, including centralized and spoke VPCs. For more information about centralized VPCs, see Interface VPC endpoints in the Amazon Whitepaper - Building a Scalable and Secure Multi-VPC Amazon Network Infrastructure.

  • Shared VPC – If you use a shared VPC, GuardDuty uses that shared VPC to receive runtime events from your resources after the prerequisites are met. See Using shared VPC with Runtime Monitoring.