<story><title>AWS GuardDuty – the Good, the Bad, and the Ugly</title><url>https://badshah.io/guardduty-good-bad-ugly/</url></story><parent_chain><item><author>m1keil</author><text>GuardDuty is another example of brilliance of AWS pricing scheme and how they manage to twist your hand to pay extra which can cost quite a lot in the end of the month.&lt;p&gt;When comparing EC2 to servers, nobody adds the added premiums of the extras. Things like CloudTrail, Support, GuardDuty, CloudWatch. All of these things have a variable cost that grows with usage and very hard to predict ahead of time.&lt;p&gt;Just last week I discovered our GuardDuty bills went up from $15&amp;#x2F;month to $400&amp;#x2F;month. Inspecting closer, the issue was a small script that did AWS API call at a tight while loop in a couple of EC2 instances.&lt;p&gt;So if you choose to enable GD, make sure to have your monitoring in place, gradually enable GD across the infra and establish clear baselines and alerting in place for costs.</text></item></parent_chain><comment><author>psanford</author><text>Its quite annoying that you can&amp;#x27;t disable parts of guardduty you don&amp;#x27;t get much value from. I think the CloudTrail monitoring is quite useful and the VPC flowlog monitoring is basically useless (to me, I have other means of doing host and network based monitoring, I&amp;#x27;m sure that there are a lot of people who get meaningful value out of it). I&amp;#x27;d like to be able to turn off flowlog monitoring and just use guardduty for cloudtrail monitoring, but that isn&amp;#x27;t an option. So I can either overpay for a bunch of extra things I don&amp;#x27;t get any value from or not enable guardduty at all.</text></comment>
<story><title>AWS GuardDuty – the Good, the Bad, and the Ugly</title><url>https://badshah.io/guardduty-good-bad-ugly/</url></story><parent_chain><item><author>m1keil</author><text>GuardDuty is another example of brilliance of AWS pricing scheme and how they manage to twist your hand to pay extra which can cost quite a lot in the end of the month.&lt;p&gt;When comparing EC2 to servers, nobody adds the added premiums of the extras. Things like CloudTrail, Support, GuardDuty, CloudWatch. All of these things have a variable cost that grows with usage and very hard to predict ahead of time.&lt;p&gt;Just last week I discovered our GuardDuty bills went up from $15&amp;#x2F;month to $400&amp;#x2F;month. Inspecting closer, the issue was a small script that did AWS API call at a tight while loop in a couple of EC2 instances.&lt;p&gt;So if you choose to enable GD, make sure to have your monitoring in place, gradually enable GD across the infra and establish clear baselines and alerting in place for costs.</text></item></parent_chain><comment><author>ramraj07</author><text>The biggest “hidden” cost for me was Elastic Blockstore IO charges! It started adding up quite quickly and I realized I had to think twice about doing IO intensive calculations on EC2! I switched over to lightsail (obviously these are for personal projects).</text></comment>