aws-guardduty

GuardDuty bills across nine separate data sources — CloudTrail management events at $4/M tiered down, VPC Flow Logs at $1/GB tiered, EKS Runtime Monitoring per vCPU-hour, plus S3, DNS, Lambda, RDS, and Malware Protection. The 30-day free trial regularly hides the true production bill, and organization-wide auto-enable turns every new account into a billing line.