Each new GuardDuty account, in each Region, receives a 30-day free trial of GuardDuty, including the Malware Protection feature (only for EBS data volume scans that are initiated by GuardDuty; there is not a free trial for Malware Protection for Amazon S3). Existing GuardDuty accounts receive a 30-day trial of Malware Protection at no additional charge the first time it is enabled in an account. During the trial period, you can estimate the post-trial costs estimate on the GuardDuty console usage page. If you are a GuardDuty administrator, you will see the estimated costs for your member accounts. After 30 days, you can view actual costs of this feature in the AWS Billing console.
Pricing for malware scanning of EBS volumes is based on the GB of data scanned in a volume. You can apply customizations using scan options from the console to mark some Amazon EC2 instances, using tags, to be included or excluded from scanning, thus controlling the cost. In addition, GuardDuty will only scan an Amazon EC2 instance once every 24 hours. If GuardDuty generates multiple Amazon EC2 findings for an Amazon EC2 instance within 24 hours, a scan will only occur for the first relevant Amazon EC2 finding. If Amazon EC2 findings continue, for an instance, 24 hours after the last malware scan, a new malware scan will be initiated for that instance.
Pricing for malware scanning of storage objects in S3 buckets is based on the GB of data scanned, as well as the number of files scanned in a designated S3 bucket that is configured for malware scanning. GuardDuty will only scan for newly-uploaded files into configured buckets, and will not scan existing files or files in buckets not designated for malware scanning.