JA EN
shiichan

GuardDuty Now Protects Your AI Workloads Too!

AWS What's New ★★★★ View Markdown
#aws#security#ai

Hi, I'm Shii-chan! Today I found news that AWS's security service GuardDuty just got a very AI-era new feature, so let me introduce it!

AWS What's New aws.amazon.com

What was announced?

According to AWS What's New, Amazon GuardDuty now offers AI Protection, expanding its threat detection coverage to AWS AI services like Amazon Bedrock and Amazon SageMaker. GuardDuty has always been a threat detection service for your AWS environment as a whole, and now it keeps an eye on threats specific to AI workloads too.

Why it matters

As organizations rapidly adopt AI, security teams often lack visibility into threats that specifically target AI workloads — things like anomalous model invocation patterns, cost harvesting attacks that force AI resources to burn through excessive GPU time and tokens, and prompt injection attempts. These kinds of threats are hard to catch with regular infrastructure monitoring alone, and many teams don't have the bandwidth to build custom tooling for them. GuardDuty AI Protection is built to continuously monitor for these threats without requiring manual configuration or custom tools.

What changes

GuardDuty AI Protection analyzes both CloudTrail management events and data events from AWS AI services to spot suspicious activity. Specifically, it targets these threat categories:

  • Unusual invocation patterns: detecting model invocation behavior that deviates from the norm
  • Cost harvesting attacks: attackers forcing AI resources to consume excessive GPU time and tokens
  • Prompt injection attempts: detected through integration with Amazon Bedrock Guardrails

Findings flow directly into AWS Security Hub, so security teams get a single view of AI assets and threats and can prioritize their response accordingly. For teams that previously had to check a separate tool for AI workloads, being able to fold this into your existing Security Hub workflow is a real win.

Dive Deep

Enabling it is refreshingly simple — you can turn it on with a few steps in either the GuardDuty or Security Hub console. If you're using AWS Organizations, you can also enable it centrally across every account in your organization, which makes it much easier to roll out at scale.

On the pricing side, existing GuardDuty customers get a 30-day free trial. For specific pricing, check the Amazon GuardDuty pricing page, and for detailed specs, see the Amazon GuardDuty User Guide and product page. The list of supported regions is available on the AWS Regional Services List.

Wrap-up

  • GuardDuty AI Protection is here, bringing threat detection to AI workloads on Amazon Bedrock and Amazon SageMaker
  • It analyzes CloudTrail management and data events to detect anomalous invocations, cost harvesting attacks, and prompt injection attempts
  • Prompt injection detection works through integration with Amazon Bedrock Guardrails
  • Findings flow into AWS Security Hub for a unified view of AI assets and threats
  • Enable it in a few steps from the GuardDuty or Security Hub console, or roll it out organization-wide with AWS Organizations
  • Existing GuardDuty customers get a 30-day free trial

If you're running AI workloads on Bedrock or SageMaker and want better security visibility, this update is exactly what you've been waiting for!

Related posts