Nine meters, one compounding bill
Amazon GuardDuty Pricing Calculator
Estimate org-wide GuardDuty after the 30-day trial — see which data source dominates before you auto-enable Runtime Monitoring.
- No signup
- Instant results
- ~3 min
Rates reviewed
Read the full breakdown — Amazon GuardDuty Pricing covers billing dimensions, traps, and a 30-day cleanup plan.
Which data sources are enabled?
us-east-1list rates, pricing as of 2026-10-17. 30-day free trial not modeled. Volumes are per account-region; multiplied by account × region count. VPC Flow Logs from instances running the Runtime Monitoring agent are not billed — reduce VPC Flow GB accordingly. EBS malware scans ($0.03/GB) and the S3 malware free tier are not modeled. Source: AWS public pricing.
Per account-region volumes
Enter typical monthly volumes for one account in one region. We multiply by your account and region counts.
vCPU-months = hours monitored × vCPUs ÷ hours in the month.
Lambda Protection bills VPC Flow Logs from VPC-attached functions — tiered $1/$0.50/$0.25 per GB.
Provisioned instance vCPUs, e.g. db.r6g.xlarge = 4. Data activity ($3.00/vCPU) and Aurora Serverless v2 ($0.25/ACU) not modeled.
Estimated GuardDuty Cost
Org-wide estimate
Total Monthly Cost
live resultFull per-source breakdown unlocks after email
Unlock GuardDuty Cost Breakdown
See S3, EKS Audit, Lambda, RDS, and Malware line items plus scoping guidance.
Full breakdown unlocked
Detailed line items are now visible.
Want this applied to your real account?
FactualMinds scopes GuardDuty data sources per account tier, integrates findings with Security Hub, and prevents day-31 bill shocks.
Talk to Security Experts →Who This Tool Is For
Security and platform teams enabling GuardDuty org-wide with FinOps accountability for the post-trial bill.
Why We Built This Tool
GuardDuty is nine independent meters — the 30-day free trial hides Runtime Monitoring and multi-account CloudTrail analysis until production rates kick in.
What Problem It Solves
- Runtime Monitoring. $1.50/vCPU-month (first 500 vCPUs) scales with every EKS node — often the largest line on container-heavy bills.
- Org-wide auto-enable. Every new account becomes a billing multiplier with the same data sources.
- Tiered rates. Small accounts pay top-tier rates on every event until volume tier-down kicks in.
Read the GuardDuty pricing deep-dive or explore cloud security services.
Frequently Asked Questions
How does the 30-day free trial affect estimates?
This calculator models production rates after the trial. Use the GuardDuty console Usage page during the trial to validate projected monthly cost before day 31.
Which data source typically dominates?
Container-heavy orgs: Runtime Monitoring. High API velocity: CloudTrail events. Network-heavy: VPC Flow Logs. Check per-source breakdown in the console.
How does multi-account pricing compound?
GuardDuty is enabled per account per region. This calculator multiplies per-account-region volumes by account count × region count.
When should I enable Runtime Monitoring?
On production EKS/ECS/EC2 where runtime threat detection is a compliance requirement. Skip dev, staging, and CI clusters.
How is GuardDuty CloudTrail pricing different from CloudTrail?
CloudTrail bills for logging; GuardDuty bills separately for analyzing management events. Model logging with the CloudTrail calculator.
Does DNS analysis bill separately?
DNS log analysis is bundled with the VPC Flow Logs data source tier — no separate per-GB DNS charge.
