GuardDuty is a pay-as-you-go service, and you only pay for the usage you incur. GuardDuty prices are based on the volume of analyzed service logs, virtual CPUs (vCPUs) or Aurora Serverless v2 instance Aurora capacity units (ACUs) for Amazon RDS event analysis, the number and size of Amazon Elastic Kubernetes Service (Amazon EKS) or Amazon Elastic Container Service (Amazon ECS) workloads being monitored at runtime, and the volume of data scanned for malware.
Analyzed service logs are filtered for cost optimization and directly integrated with GuardDuty, which means you don’t have to activate or pay for them separately. If EKS Runtime Monitoring is enabled for your account, you will not be charged for analysis of VPC Flow Logs from instances where the GuardDuty agent is deployed and active. The runtime security agent provides us with similar (and more contextual) network telemetry data. Hence, to avoid double charging customers, we will not charge for VPC Flow Logs from Amazon Elastic Compute Cloud (Amazon EC2) instances where the agent is installed.
See Amazon GuardDuty pricing for additional details and pricing examples.