# Pricing transcribed from the provider's own page — see provenance. Numbers are quoted, not derived.
generated: '2026-10-07'
method: searched
source: https://aws.amazon.com/guardduty/pricing/
sources:
- https://aws.amazon.com/guardduty/pricing/
provenance:
  tool: all/0-working/economics/harvest_pricing.py
  run: 20261007T104522
  grounding: every price_text was found verbatim in the fetched page text
audience: developer-api
pricing_basis: usage-other
delivery:
  delivery: managed
  method: page
  read: '2026-10-07'
published: true
note: Live pricing tables render via placeholder tokens (region-dependent); numeric values captured come
  from the page's worked pricing examples for US East (N. Virginia). 30-day free trial per account/Region;
  Malware Protection for S3 has a monthly free tier of 1000 requests and 1GB.
plan_count: 13
currency: USD
plans:
- name: CloudTrail management event analysis
  price_text: $4.00
  price: 4.0
  currency: USD
  period: per-use
  unit: per one million management events
  included_quota: 30-day free trial
- name: VPC Flow Logs and DNS query log analysis (first 500 GB)
  price_text: $1.00
  price: 1.0
  currency: USD
  period: per-use
  unit: per GB
  overage: $0.50 (next 2,000 GB); $0.25 (last 500 GB)
- name: CloudTrail S3 data event analysis
  price_text: $0.80
  price: 0.8
  currency: USD
  period: per-use
  unit: per million data events (first 500 million)
  overage: $0.40 (next 500 million data events, priced per million)
- name: EKS audit logs
  price_text: $1.60
  price: 1.6
  currency: USD
  period: per-use
  unit: per million events (first 100 million)
  overage: $0.80 (next 100 million events, priced per million)
- name: Runtime Monitoring (EKS/ECS/EC2)
  price_text: $1.50 per vCPU (for first 500 vCPUs)
  price: 1.5
  currency: USD
  period: month
  unit: per vCPU
  overage: $0.75 per vCPU (for next 4,500 vCPUs)
- name: Malware Protection for EC2 (EBS data scanned)
  price_text: $0.03 per GB
  price: 0.03
  currency: USD
  period: per-use
  unit: per GB scanned
- name: Malware Protection for S3
  price_text: $0.09 per GB
  price: 0.09
  currency: USD
  period: per-use
  unit: per GB scanned
  included_quota: Free Tier allowance of 1000 requests and 1GB per month
  overage: 4,000/1,000 * $0.215 for objects evaluated
- name: Malware Protection for AWS Backup
  price_text: $0.05 per GB
  price: 0.05
  currency: USD
  period: per-use
  unit: per GB backup data scanned
- name: RDS Protection
  price_text: $1.00 (per vCPU)
  price: 1.0
  currency: USD
  period: month
  unit: per vCPU
  overage: $0.25 (per ACU) for Aurora Serverless v2
- name: RDS Protection Europe (Spain)
  price_text: $1.09 per vCPU per month
  price: 1.09
  currency: USD
  period: month
  unit: per vCPU
- name: RDS Protection Europe (Zurich)
  price_text: $1.35 per vCPU per month
  price: 1.35
  currency: USD
  period: month
  unit: per vCPU
- name: Lambda Protection network activity log analysis
  price_text: $1.00 (first 500 GB)
  price: 1.0
  currency: USD
  period: per-use
  unit: per GB
- name: AI Protection CloudTrail AI data event analysis
  price_text: $1.00 (first 500 GB)
  price: 1.0
  currency: USD
  period: per-use
  unit: per GB
rate_limit_statements:
- attached EBS volumes over 2 TB (2,048 GB) are not scanned
x-canonical:
  generated: '2026-10-08'
  vocabulary: all/0-working/economics/plans-canonical.yml
  models:
  - hybrid
  - subscription
  units:
  - data
  plans:
  - name: CloudTrail management event analysis
    access: other
    model: subscription
    model_how: derived
    units:
    - other
    periods:
    - other
  - name: VPC Flow Logs and DNS query log analysis (first 500 GB)
    access: other
    model: hybrid
    model_how: derived
    units:
    - data
    periods:
    - other
  - name: CloudTrail S3 data event analysis
    access: other
    model: hybrid
    model_how: derived
    units:
    - other
    periods:
    - other
  - name: EKS audit logs
    access: other
    model: hybrid
    model_how: derived
    units:
    - other
    periods:
    - other
  - name: Runtime Monitoring (EKS/ECS/EC2)
    access: other
    model: hybrid
    model_how: derived
    units:
    - other
    periods:
    - month
  - name: Malware Protection for EC2 (EBS data scanned)
    access: other
    model: hybrid
    model_how: derived
    units:
    - data
    periods:
    - other
  - name: Malware Protection for S3
    access: other
    model: hybrid
    model_how: derived
    units:
    - data
    periods:
    - other
  - name: Malware Protection for AWS Backup
    access: other
    model: hybrid
    model_how: derived
    units:
    - data
    periods:
    - other
  - name: RDS Protection
    access: other
    model: hybrid
    model_how: derived
    units:
    - other
    periods:
    - month
  - name: RDS Protection Europe (Spain)
    access: other
    model: subscription
    model_how: derived
    units:
    - other
    periods:
    - month
  - name: RDS Protection Europe (Zurich)
    access: other
    model: subscription
    model_how: derived
    units:
    - other
    periods:
    - month
  - name: Lambda Protection network activity log analysis
    access: other
    model: hybrid
    model_how: derived
    units:
    - data
    periods:
    - other
  - name: AI Protection CloudTrail AI data event analysis
    access: other
    model: hybrid
    model_how: derived
    units:
    - data
    periods:
    - other