Security & identity
Amazon GuardDuty
- Timebilled
- Bytesbilled
- Callsbilled
In one line
Priced on what it reads: per CloudTrail event, per GB of log data analyzed, per vCPU-month of runtime agent.
What gets missed
The per-GB meter counts log volume analyzed, so keeping traffic inside the VPC saves nothing. You never enable or pay for those VPC flow and DNS logs yourself; GuardDuty consumes them directly.
Find it on your bill
Filter Cost Explorer or your Cost and Usage Report by these usage types. A usage type with no region prefix means us-east-1.
PaidEventsAnalyzedPaidEventsAnalyzed-BytesPaidEC2vCPUMonitored
Bills the same way
These services turn exactly the same meters, so what you learn here transfers.