Amazon GuardDuty Pricing Calculator
Estimate org-wide GuardDuty after the 30-day trial — see which data source dominates before you auto-enable Runtime Monitoring.
- No signup
- Instant results
- ~3 min
Rates reviewed
Read the full breakdown — Amazon GuardDuty Pricing covers billing dimensions, traps, and a 30-day cleanup plan.
Which data sources are enabled?
us-east-1list rates, pricing as of 2026-06-26. 30-day free trial not modeled. Volumes are per account-region; multiplied by account × region count. Source: AWS public pricing.
Who This Tool Is For
Security and platform teams enabling GuardDuty org-wide with FinOps accountability for the post-trial bill.
Why We Built This Tool
GuardDuty is nine independent meters — the 30-day free trial hides Runtime Monitoring and multi-account CloudTrail analysis until production rates kick in.
What Problem It Solves
- Runtime Monitoring. ~$0.008/vCPU-hour scales with every EKS node — often the largest line on container-heavy bills.
- Org-wide auto-enable. Every new account becomes a billing multiplier with the same data sources.
- Tiered rates. Small accounts pay top-tier rates on every event until volume tier-down kicks in.
Read the GuardDuty pricing deep-dive or explore cloud security services.
Frequently Asked Questions
How does the 30-day free trial affect estimates?
This calculator models production rates after the trial. Use the GuardDuty console Usage page during the trial to validate projected monthly cost before day 31.
Which data source typically dominates?
Container-heavy orgs: Runtime Monitoring. High API velocity: CloudTrail events. Network-heavy: VPC Flow Logs. Check per-source breakdown in the console.
How does multi-account pricing compound?
GuardDuty is enabled per account per region. This calculator multiplies per-account-region volumes by account count × region count.
When should I enable Runtime Monitoring?
On production EKS/ECS/EC2 where runtime threat detection is a compliance requirement. Skip dev, staging, and CI clusters.
How is GuardDuty CloudTrail pricing different from CloudTrail?
CloudTrail bills for logging; GuardDuty bills separately for analyzing management events. Model logging with the CloudTrail calculator.
Does DNS analysis bill separately?
DNS log analysis is bundled with the VPC Flow Logs data source tier — no separate per-GB DNS charge.
Related AWS Tools
CloudTrail Pricing Calculator
Audit logging cost separate from GuardDuty analysis.
EKS Pricing Calculator
Cluster compute that drives Runtime Monitoring vCPU-hours.
CloudWatch Pricing Calculator
Flow log ingestion before GuardDuty analysis.
VPC Pricing Calculator
Network paths that generate Flow Log volume.