GuardDuty Runtime Monitoring shifts to Security Hub billing

GuardDuty Runtime Monitoring is now a line item under Security Hub's Threat Analytics plan.

What changed

• GuardDuty Runtime Monitoring charges are now consolidated under the AWS Security Hub Threat Analytics plan.
• Usage is metered as a single type across EC2, EKS, and ECS on Fargate, rather than separate charges per resource.
• No configuration changes or re-deployment of GuardDuty security agents are required.

Why it matters

This change simplifies billing for organizations using both GuardDuty Runtime Monitoring and Security Hub. The honest version: Previously, customers received separate GuardDuty charges for Runtime Monitoring on EC2 instances, EKS clusters, and ECS tasks. Now, this cost is bundled into the Security Hub Threat Analytics plan, appearing as a single line item. This should reduce invoice complexity for users already invested in Security Hub's broader threat intelligence capabilities. The detection coverage and finding types remain unchanged, meaning no immediate migration effort is needed for existing deployments.

The catch

While billing is simplified, this announcement does not introduce a new free trial for Runtime Monitoring. The existing free trial for the Security Hub Threat Analytics plan remains separate from the Security Hub Essentials plan free trial. Watch out: Customers need to actively monitor their Security Hub Threat Analytics plan costs via AWS Cost Explorer or the Security Hub usage page to understand the financial impact, as the bundled pricing may differ from previous individual GuardDuty charges. The change is only effective in regions where Security Hub is available.

Ship it

If you are using GuardDuty Runtime Monitoring and Security Hub, review your AWS Cost Explorer or the Security Hub usage page in the AWS Security Hub console to compare your previous GuardDuty charges against the new Security Hub Threat Analytics plan billing. This is particularly relevant for accounts in regions like us-east-1 or eu-west-1 where both services are widely deployed.

Bottom line: GuardDuty Runtime Monitoring costs are now part of Security Hub's Threat Analytics plan, simplifying billing but not altering detection capabilities or trials.

— Filed to /aws