Amazon GuardDuty

Amazon GuardDuty is a threat detection service that continuously monitors AWS accounts, workloads, and network activity for suspicious behavior by analysing CloudTrail, VPC flow, and DNS data sources. It generates prioritized security findings and alerts rather than performing remediation. GuardDuty is typically used as an account- and region-level detection layer that integrates with aggregation and automation services in an AWS security architecture.

🗂 Resource Category

Security, Identity, and Compliance • Management and Governance

🧠 Exam Memory Hook

Think: "Account logs + network flows + threat intel = Amazon GuardDuty"

📖 Ownership

Classification: AWS Managed Service

AWS responsibilities: AWS operates and maintains the GuardDuty service platform, the underlying control plane, and the physical infrastructure that runs the service, and is responsible for patching and securing that infrastructure and the managed service runtime. AWS manages service availability, scaling of the detection engine, and the GuardDuty console and API endpoints. AWS is not responsible for securing customer data sources or for responding to findings in customer accounts unless additional automated remediation is implemented by the customer.

Customer responsibilities: The customer configures detectors, enables data sources (for example CloudTrail management events, VPC Flow Logs, DNS logs, and S3 data events where applicable), configures member accounts or delegated administrator setup for Organizations, reviews and triages findings, and integrates GuardDuty findings with their SIEM or automation workflows. The customer defines remediation actions, enforces IAM permissions for access to findings, and monitors GuardDuty usage, findings, and alerts. The customer also configures any automated response (for example with EventBridge, Lambda, or Systems Manager) and is responsible for testing and maintaining those automations.

Patching responsibilities: AWS patches the physical infrastructure and the managed GuardDuty service platform runtime. AWS secures and patches the control plane and service components it operates. The customer patches guest operating systems, application runtimes, libraries, dependencies, and customer-deployed applications on their EC2 instances or other compute resources that GuardDuty monitors. GuardDuty, as a detection service, does not patch or remediate monitored resources; remediation and patching of affected resources remain the customer's responsibility.

🏗 Typical Architecture

💡 Top 5 Features

Continuous threat detection using account activity, VPC flow logs, and DNS data sources to generate prioritized findings.
Integration with EventBridge and AWS Security Hub for exporting findings and enabling automated workflows or aggregation.
Multi-account support with delegated administrator capabilities for centralized management across AWS Organizations.
S3 data event analysis support to identify suspicious object-level API activity when configured.
Findings include contextual information and metadata to support triage and investigation workflows.

✅ Top 5 Use Cases

Detecting suspicious or unauthorized API activity in an AWS account by analysing CloudTrail management events.
Identifying lateral movement or unusual network traffic patterns using VPC Flow Logs to detect compromised instances.
Detecting suspicious DNS queries and domain activity through DNS or Route 53 Resolver logs to identify command-and-control behavior.
Centralizing detection across multiple AWS accounts by using a delegated administrator and forwarding findings to a central SIEM via EventBridge.
Feeding GuardDuty findings into automated response pipelines (for example EventBridge → Lambda) to trigger containment or investigation playbooks.

🏗 Architecture Placement

GuardDuty sits as a detection layer at the account and regional level (with organization-level management options) and ingests telemetry such as CloudTrail events, VPC Flow Logs, DNS logs, and optional S3 data events. It produces findings that are viewed in the GuardDuty console and can be forwarded to EventBridge, Security Hub, or external SIEM/automation tools. GuardDuty does not sit inline with traffic and does not perform blocking; it provides alerts that other services or automations use for remediation. Placement depends on enabling the required data sources and, for multi-account deployments, configuring a delegated administrator through AWS Organizations.

🎯 Commonly Used With

- Amazon CloudWatch
- AWS Lambda
- AWS Security Hub
- Amazon VPC
- AWS Identity and Access Management

🌍 5 Real-World Examples

A bank enables GuardDuty to detect unusual console or API activity across member accounts and forwards findings to a central SOC for investigation to reduce time-to-detect compromised credentials.
A healthcare provider uses GuardDuty's VPC flow and DNS detections to identify possible lateral movement between instances and to trigger containment automation for affected workloads.
An online retailer configures S3 data event analysis to surface suspicious object access patterns and then routes high-priority findings to an incident response pipeline.
A telecommunications operator centralizes GuardDuty in a delegated administrator account to aggregate findings from dozens of accounts and integrate them with an on-premises SIEM.
A technology organization integrates GuardDuty findings with EventBridge and Lambda to automate instance isolation when network-based indicators of compromise are detected.

🎓 AWS Exam Clues

GuardDuty is a detection service that generates findings; remediation requires separate controls or automation.
You must enable appropriate data sources (CloudTrail, VPC Flow Logs, DNS logs, S3 data events) for GuardDuty to produce relevant findings.
GuardDuty supports multi-account centralization via a delegated administrator configured through AWS Organizations.
Findings can be exported to EventBridge and AWS Security Hub for aggregation, alerting, and automated responses.
GuardDuty operates at the account and regional level with organization-level management options, not as an inline blocking appliance.

📝 Quick Revision

Amazon GuardDuty provides continuous threat detection for AWS accounts by analysing CloudTrail, VPC flow, DNS, and optional S3 data events and producing prioritized findings. Use it when you need an AWS-managed detection layer with multi-account visibility and integration to EventBridge or Security Hub; remember it detects and reports issues but does not remediate or patch monitored resources.

🏷 Keywords

Threat detection • Findings • CloudTrail • VPC Flow Logs • DNS logs • S3 data events • EventBridge • AWS Security Hub • Machine learning • Delegated administrator • Multi-account • Detector