GuardDuty Runtime Monitoring is now part of the Security Hub Threat Analytics plan!
Hi everyone, Shii-chan here! Today's news is about tidying up pricing!
AWS What's New
aws.amazon.com
What was announced?
According to AWS What's New, Amazon GuardDuty Runtime Monitoring is now included in the AWS Security Hub Threat Analytics plan.
Runtime Monitoring inspects operating system, network, and file activity to surface threats such as container escapes, privilege escalation, and cryptomining. It covers Amazon EC2 instances, Amazon EKS clusters, and Amazon ECS tasks on AWS Fargate.
The story so far
Previously, Runtime Monitoring usage was billed separately under GuardDuty.
What changes
- If Security Hub is enabled in an account and Region, you no longer receive separate GuardDuty charges for Runtime Monitoring there
- That usage now appears on your bill under AWS Security Hub
- Security Hub meters it as a single usage type spanning EC2, EKS, and ECS on Fargate
Your detection coverage, finding types, and GuardDuty security agents stay the same, and you do not need to reconfigure anything.
Dive Deep
A few things to note:
- The free trial for the Threat Analytics plan is separate from the free trial for the Security Hub Essentials plan
- This change does not add a new free trial for Runtime Monitoring
You can see how the change affects your bill in AWS Cost Explorer or on the Security Hub usage page.
Wrap-up
- GuardDuty Runtime Monitoring is included in the Security Hub Threat Analytics plan
- No separate GuardDuty charges where Security Hub is enabled
- Billing moves to Security Hub, and no reconfiguration is needed
- Free trials are separate, and no new free trial is added
This is for security and FinOps folks who want to tidy up Security Hub and GuardDuty billing!
