# Amazon GuardDuty

> An AWS service that watches your account's activity and flags signs of an attack.

- Level: Intermediate
- Topics: AWS, Security
- URL: https://tidbit.legios.com.ar/amazon-guardduty/
- In Spanish: [Amazon GuardDuty](https://tidbit.legios.com.ar/es/amazon-guardduty/)

**Amazon GuardDuty** is a threat detection service for AWS. Once you turn it on, it starts reading the activity logs your account already produces, such as CloudTrail events (who called which API), VPC flow logs (which machines talked to which) and DNS queries, and looks for patterns that suggest something is wrong. You do not install agents or write rules to get started.

When it spots something suspicious it creates a **finding**: a short report with a type, a severity and the resources involved. Examples are access keys being used from an unusual country, an EC2 instance talking to a known cryptomining server, malware in a file uploaded to S3, or a sequence of small steps that together look like an attacker moving through the account. It combines lists of known bad IP addresses and domains with machine learning that learns what is normal for you.

GuardDuty only detects; it does not block. Teams usually send its findings to an alerting channel or to automation that reacts, for example disabling a leaked key. It complements, rather than replaces, good IAM permissions, AWS WAF in front of web apps, and AWS Config for checking settings.

## An analogy

A security guard watching the building's cameras and badge logs all night. They do not lock doors themselves, but they call you the moment someone badges in at 3 a.m. from a door nobody uses.

## Keep in mind

- Detects threats by analyzing logs your AWS account already produces.
- Each detection is a finding with a type, severity and affected resources.
- Uses threat intelligence lists plus machine learning about your normal behavior.
- It alerts but does not block; you decide or automate the response.

## Go deeper

- [What is Amazon GuardDuty? (official docs)](https://docs.aws.amazon.com/guardduty/latest/ug/what-is-guardduty.html)
- [Amazon GuardDuty product page](https://aws.amazon.com/guardduty/)

## Related terms

- [AWS CloudTrail](https://tidbit.legios.com.ar/aws-cloudtrail/): The logbook of an AWS account: who did what, when, and from where.
- [API](https://tidbit.legios.com.ar/api/): The menu of things one program lets another program ask for.
- [Amazon VPC](https://tidbit.legios.com.ar/amazon-vpc/): Your own private slice of the AWS network, with walls you draw yourself.
- [DNS](https://tidbit.legios.com.ar/dns/): The internet's phone book: it turns names like wikipedia.org into IP addresses.
- [AI agent](https://tidbit.legios.com.ar/ai-agent/): An LLM that can take actions, check the results and keep going until the job is done.
- [Amazon EC2](https://tidbit.legios.com.ar/amazon-ec2/): Virtual computers you rent by the hour, in any size, and switch off when done.
- [Server](https://tidbit.legios.com.ar/server/): A computer whose job is to answer requests from other computers, all day, every day.
- [Malware and ransomware](https://tidbit.legios.com.ar/malware-and-ransomware/): Software built to harm you; ransomware locks your files and charges to unlock them.