AWS Config monitors that your resources comply with the rules (subchapter 23.2). But there is another dimension of security: detecting ongoing attacks and malicious behaviors. What if someone steals credentials? What if a server is being used to mine cryptocurrencies without your knowledge? To detect these active threats there is GuardDuty, AWS's intelligent threat detection system.

Compliance rules (Config) detect misconfigurations, but they don't detect an attacker in action. An attacker who has obtained valid credentials can, technically, be "complying with the rules" while stealing data. You need something that detects suspicious behaviors, patterns that reveal an attack:

• Someone accessing from a country where you never operate, at 4 a.m.
• A server communicating with addresses known to be malicious.
• Massive access attempts or attempts to discover your infrastructure.
• A resource behaving abnormally (suddenly mining cryptocurrencies).

GuardDuty is a threat detection service that continuously analyzes the activity of your AWS account for malicious or suspicious behaviors. It uses intelligence (machine learning, known threat lists, pattern analysis) to detect what a human could not monitor.

Analogy: GuardDuty is like an intelligent alarm system with cameras for your house. It doesn't just detect an open door (that would be Config); it detects suspicious behaviors: someone lurking at night, a forced window, movement where there shouldn't be any. And it learns what is "normal" in your house to distinguish the anomalous. When it sees something strange, it alerts you.

GuardDuty examines several sources of information from your account, without you having to install anything on your servers (this is called "agentless"):

• API activity logs (CloudTrail): who does what in your account.
• Network traffic (VPC Flow Logs): who your resources communicate with.
• DNS queries: which domains your resources access (reveals connections to malicious sites).
• And more sources, depending on the protections you enable.

From there, it cross-references that information with threat intelligence (lists of known malicious IPs and domains) and with behavioral models that learn what is normal in your account.

GuardDuty generates findings when it detects something suspicious. Typical examples:

Each finding comes with a severity level (low, medium, high) so you can prioritize.

What's remarkable about GuardDuty is how easy it is: you enable it and it starts monitoring automatically, without installing agents on your servers, without configuring complex rules, and without affecting the performance of your resources (it analyzes logs and metadata, does not interfere with your application). AWS takes care of all the intelligence.

Detection is the first step; then you have to react. GuardDuty findings can be connected with other services for an automatic response:

This enables automatic incident response: for example, if GuardDuty detects a compromised server mining crypto, a Lambda can isolate it from the network instantly, containing the attack before a human even reads the alert.

Real-world example: a startup enables GuardDuty in its account. One night, an attacker obtains an access key leaked by mistake in a public repository. They try to use it to launch dozens of expensive servers (to mine crypto). GuardDuty detects the anomalous pattern—"these credentials had never launched so many servers, and from an unknown IP"—and generates a high severity finding. An automation revokes the key and alerts the team. The attack is contained in minutes, avoiding a huge bill and a security breach.

GuardDuty adds the layer of active threat detection to your security. Remember the layers we've covered:

Each covers something different. GuardDuty is the "eyes" watching if someone is attacking right now.

• Compliance rules (Config) detect misconfigurations, but not an attacker in action; that's what threat detection is for.
• GuardDuty continuously analyzes the activity of your account (accesses, network traffic, DNS) with intelligence (machine learning + threat lists) to detect malicious or suspicious behaviors. Like an intelligent alarm with cameras that learns what is normal.
• It detects threats like compromised credentials, communication with malicious IPs, reconnaissance, crypto mining, and data exfiltration, generating findings with severity level.
• It is enabled with one click, no agents, no complex configuration, and no impact on performance: AWS provides all the intelligence.
• Findings are connected with EventBridge + Lambda for automatic incident response (isolate a resource, revoke credentials, alert).
• It adds the layer of active attack detection to defense in depth.

In the next subchapter, we will see how to have a centralized view of all your security with Security Hub.