AWS GuardDuty – the Good, the Bad, and the Ugly
1–10 of 59 posts
Re: AWS GuardDuty – the Good, the Bad, and the Ugly
#2GuardDuty is another example of brilliance of AWS pricing scheme and how they manage to twist your hand to pay extra which can cost quite a lot in the end of the month.
When comparing EC2 to servers, nobody adds the added premiums of the extras. Things like CloudTrail, Support, GuardDuty, CloudWatch. All of these things have a variable cost that grows with usage and very hard to predict ahead of time.
Just last week I discovered our GuardDuty bills went up from $15/month to $400/month. Inspecting closer, the issue was a small script that did AWS API call at a tight while loop in a couple of EC2 instances.
So if you choose to enable GD, make sure to have your monitoring in place, gradually enable GD across the infra and establish clear baselines and alerting in place for costs.
Re: AWS GuardDuty – the Good, the Bad, and the Ugly
#3> The Ugly
> Cost can get sky-high
Is there _any_ service on AWS where you feel like you're getting more value than the dollars you're paying with (other than IAM and Free tier services)? It's no secret that AWS is one of the most successful and profitable modern businesses, but perhaps there's a hidden offering that does something, does it well, and costs very little compared to the value it brings.
Re: AWS GuardDuty – the Good, the Bad, and the Ugly
#4> The Ugly > Cost can get sky-high Is there _any_ service on AWS where you feel like you're getting more value than the dollars you're paying with (other than IAM and Free tier services)? It's no secret that AWS is one of the most successful and profitable modern businesses, but perhaps there's a hidden offering that does something, does it well, and costs very little compared to the value it brings.
RDS is one for me. I’ve set up a regionally replicated, point-in-time backuped DB cluster and have no desire to run one again.
Re: AWS GuardDuty – the Good, the Bad, and the Ugly
#5> The Ugly > Cost can get sky-high Is there _any_ service on AWS where you feel like you're getting more value than the dollars you're paying with (other than IAM and Free tier services)? It's no secret that AWS is one of the most successful and profitable modern businesses, but perhaps there's a hidden offering that does something, does it well, and costs very little compared to the value it brings.
There are a few AWS security services which are free/priced reasonably.
Some free services:
1. AWS Org (Disable services and enforce guardrails)
2. VPC (Create private networks)
3. IAM (User access and IAM policy analyzer to help with least priv)
4. IAM Access Analyzer (Alert on resources with cross account & public access)
5. SSM Inventory & Patch manager (Basic check if all VMs have security updates installed)
Reasonably priced IMO:
1. AWS WAF with free managed rules (when rightly configured you get lesser FP and high ROI)
Re: AWS GuardDuty – the Good, the Bad, and the Ugly
#6> The Ugly > Cost can get sky-high Is there _any_ service on AWS where you feel like you're getting more value than the dollars you're paying with (other than IAM and Free tier services)? It's no secret that AWS is one of the most successful and profitable modern businesses, but perhaps there's a hidden offering that does something, does it well, and costs very little compared to the value it brings.
Most if not all services, I feel are a good enough value...when I consider my "time" or hiring consultants time to do the same, etc.
A single example was GuardDuty above. I know how expensive similar to GuardDuty services are per month when you have to have a well planned strategy, implementation, execution, operations for threats... no matter if one does it "in house" or with "consultants" - the cost is very high to implement anything similar to GuardDuty. No matter if it is duct taped open source or enterprise offerings.
And then you have to do that same iterative business process loop across infrastructure (servers/database), data centers, code deployment, DevOps, security, etc etc.
Re: AWS GuardDuty – the Good, the Bad, and the Ugly
#7GuardDuty is another example of brilliance of AWS pricing scheme and how they manage to twist your hand to pay extra which can cost quite a lot in the end of the month. When comparing EC2 to servers, nobody adds the added premiums of the extras. Things like CloudTrail, Support, GuardDuty, CloudWatch. All of these things have a variable cost that grows with usage and very hard to predict ahead of time. Just last week…
Until you realize how much the alternatives cost. You think Palo Alto networks is cheap?
Re: AWS GuardDuty – the Good, the Bad, and the Ugly
#8> The Ugly > Cost can get sky-high Is there _any_ service on AWS where you feel like you're getting more value than the dollars you're paying with (other than IAM and Free tier services)? It's no secret that AWS is one of the most successful and profitable modern businesses, but perhaps there's a hidden offering that does something, does it well, and costs very little compared to the value it brings.
Lambda. I've build multi-region endpoint compute services before. Never again.
Someone else mentioned RDS and I agree with that too.
Re: AWS GuardDuty – the Good, the Bad, and the Ugly
#9> The Ugly > Cost can get sky-high Is there _any_ service on AWS where you feel like you're getting more value than the dollars you're paying with (other than IAM and Free tier services)? It's no secret that AWS is one of the most successful and profitable modern businesses, but perhaps there's a hidden offering that does something, does it well, and costs very little compared to the value it brings.
I use DynamoDB, Lambda, Fargate, and a few other services for a side business. I don't want to spend my time fiddling around with a database or EC2 instances. I'm able to run everything I need for under $100 a month without a lot of overhead, which I think is a good value. This may change as the business grows.
I can't complain about DynamoDB or Lambda pricing. Fargate is a little expensive for what we are running, but the infrastructure management tradeoff still makes it worthwhile.
Re: AWS GuardDuty – the Good, the Bad, and the Ugly
#10> The Ugly > Cost can get sky-high Is there _any_ service on AWS where you feel like you're getting more value than the dollars you're paying with (other than IAM and Free tier services)? It's no secret that AWS is one of the most successful and profitable modern businesses, but perhaps there's a hidden offering that does something, does it well, and costs very little compared to the value it brings.
Lambda/dynamo can work quite well
Dev/staging environments are virtually free
Prod will cost more depending on usage, but you could optimize costs and add caching (like cloudflare - at cdn level)