All 7 AWS Security Hub & GuardDuty questions
More in AWS Security Hub & GuardDuty
What is Amazon GuardDuty and how does it detect potential security threats within an AWS account? What is AWS Security Hub and how does it aggregate security findings from multiple sources? How can GuardDuty findings be automatically remediated using EventBridge and Lambda for a faster incident response? How can Security Hub's custom insights and automated response actions help security teams prioritize and manage findings more effectively at scale? How can an organization enable GuardDuty and Security Hub consistently across every account in an AWS Organization using delegated administration? How should a security team design an end to end incident response workflow that integrates GuardDuty, Security Hub, EventBridge, and Step Functions for both automated triage and human escalation?
Advertisement
AWS › AWS Security Hub & GuardDuty

How does GuardDuty support monitoring for threats specific to Amazon S3, EKS, and RDS beyond general EC2 and account level threats?

Intermediate

Answer

GuardDuty offers specialized protection features including S3 Protection, which analyzes S3 data events for suspicious access patterns like unusual data exfiltration attempts, EKS Protection, which monitors Kubernetes audit logs for suspicious cluster activity, and RDS Protection, which analyzes database login activity for signs of a potential compromise, extending threat detection coverage beyond general account and network level activity into these specific, commonly targeted services.
aws guardduty update-detector --detector-id abc123 --features '[{"Name":"S3_DATA_EVENTS","Status":"ENABLED"}]'
Real-world example A company enables GuardDuty's S3 Protection feature and receives an alert when an unusual pattern of large scale data downloads from a sensitive bucket is detected, potentially indicating a data exfiltration attempt by a compromised account.

Common follow-ups: What additional cost is associated with enabling these specialized GuardDuty protection features?;How does RDS Protection differ from monitoring RDS activity through CloudTrail alone?

S3 & Storage;RDS & Databases
All 7 AWS Security Hub & GuardDuty questions