My personal experience: GuardDuty is a very expensive false positive generator with a bad UI (because AWS).
If money allows, I'd look at wiz.io instead
AWS GuardDuty – the Good, the Bad, and the Ugly
31–40 of 59 posts
Re: AWS GuardDuty – the Good, the Bad, and the Ugly
#32GuardDuty is another example of brilliance of AWS pricing scheme and how they manage to twist your hand to pay extra which can cost quite a lot in the end of the month. When comparing EC2 to servers, nobody adds the added premiums of the extras. Things like CloudTrail, Support, GuardDuty, CloudWatch. All of these things have a variable cost that grows with usage and very hard to predict ahead of time. Just last week…
Until you realize how much the alternatives cost. You think Palo Alto networks is cheap?
At least you can get a fixed cost if you go that route vs. your bills growing at an exponential rate. From what I have found, PA really wants you to commit to annual pricing with their VM appliances. If you go hourly you pay 73% more.
Re: AWS GuardDuty – the Good, the Bad, and the Ugly
#33> Disable access to services in all non-active regions using SCPs. This is key advice anyway. When setting up new AWS infrastructure for a new company, set up an AWS organization, and only enable us-east-1 (required for some global services like CloudFront) and maybe one additional region (if you don't want to put all your eggs in the us-east-1 basket). Don't enable additional regions that you don't need. Because mos…
I would not start by default in us-east-1, unless you want chaos monkey as a feature.
Are there any historical metrics out there on uptime/stability by region?
Would be interesting to see a top-line comparison (GCP and Azure regions would also be neat)
Re: AWS GuardDuty – the Good, the Bad, and the Ugly
#34GuardDuty is another example of brilliance of AWS pricing scheme and how they manage to twist your hand to pay extra which can cost quite a lot in the end of the month. When comparing EC2 to servers, nobody adds the added premiums of the extras. Things like CloudTrail, Support, GuardDuty, CloudWatch. All of these things have a variable cost that grows with usage and very hard to predict ahead of time. Just last week…
Just make sure everything is multi-az that way if an entire zone goes down you will still be fine /s
Re: AWS GuardDuty – the Good, the Bad, and the Ugly
#35AWS managed to make things so much easier and cheaper compared to “classic” hosting that you now need twice as many devops employees and spend 10x in bills. Fortunately tech people aren’t financially literate so amazon can keep on squeezing all the while using free software made by the very same people. Congrats.
I mean like, this is fun to say, but y’all know this isn’t actually true right? (Well, the free software part is, but the implication in the first sentence isn’t)
The past 10-15 years has seen enormous growth in eCommerce productivity as a portion of the overall economy (just google “gdp attributed to internet commerce” and similar phrases, there’s tons of data on this). The rise in the number of devops engineers and the amounts businesses spend on AWS hosting are often in service of business models that were simply impossible to even try before cloud computing.
Sure, everyone on HN seems to have a story about an organization going all “architecture astronaut”nuts with Kubernetes and then ending up with slower/more expensive infra, and it’s fun to tell those to each other, but there’s clearly a huge amount of economic activity being enabled here that wasn’t happening before.
Re: AWS GuardDuty – the Good, the Bad, and the Ugly
#36Earlier quoted context omitted.
I use DynamoDB, Lambda, Fargate, and a few other services for a side business. I don't want to spend my time fiddling around with a database or EC2 instances. I'm able to run everything I need for under $100 a month without a lot of overhead, which I think is a good value. This may change as the business grows. I can't complain about DynamoDB or Lambda pricing. Fargate is a little expensive for what we are running, b…
> Fargate is a little expensive for what we are running Because of low usage? Lambda supports containers now (as of 2021 I think) so if you have a container to run (or something you could containerise) it's a relatively straightforward usage question which of Lambda/Fargate/EC2 makes sense on price. Lambda doesn't have to complicate comparison by being a completely different architecture/setup any more.
> Lambda supports containers now (...)
The usecases for Fargate vs Lambda are not the same. For instance, Fargate is mainly intended for servers/long-running applications, whereas Lambdas have a hard runtime cap of 15min.
Re: AWS GuardDuty – the Good, the Bad, and the Ugly
#37AWS managed to make things so much easier and cheaper compared to “classic” hosting that you now need twice as many devops employees and spend 10x in bills. Fortunately tech people aren’t financially literate so amazon can keep on squeezing all the while using free software made by the very same people. Congrats.
I actually remember the old days and no bloody thank you. Sometimes you got arcana processes managed by barely technical sysadmins so it took you 5 months to get a VM and 2 months to reimage it if you broke it. Other times you got a free for all where every engineer configures an insecure never updated server that eventually gets hacked. Then you get paged at 2am when the thing explodes and get to spend two days rebuilding it. Especially fun when you didn't build it but simply inherited a magic undocumented machine from someone who left.
Personally I care more about my enjoyment of my day to day job than saving the company a tiny bit of money that they'll never give me.
Re: AWS GuardDuty – the Good, the Bad, and the Ugly
#38> Disable access to services in all non-active regions using SCPs. This is key advice anyway. When setting up new AWS infrastructure for a new company, set up an AWS organization, and only enable us-east-1 (required for some global services like CloudFront) and maybe one additional region (if you don't want to put all your eggs in the us-east-1 basket). Don't enable additional regions that you don't need. Because mos…
I recommend AWS Control Tower for getting this all setup. It's also compatible with Terraform in more than one way.
Re: AWS GuardDuty – the Good, the Bad, and the Ugly
#39Earlier quoted context omitted.
I use DynamoDB, Lambda, Fargate, and a few other services for a side business. I don't want to spend my time fiddling around with a database or EC2 instances. I'm able to run everything I need for under $100 a month without a lot of overhead, which I think is a good value. This may change as the business grows. I can't complain about DynamoDB or Lambda pricing. Fargate is a little expensive for what we are running, b…
> Fargate is a little expensive for what we are running Because of low usage? Lambda supports containers now (as of 2021 I think) so if you have a container to run (or something you could containerise) it's a relatively straightforward usage question which of Lambda/Fargate/EC2 makes sense on price. Lambda doesn't have to complicate comparison by being a completely different architecture/setup any more.
No, the cost of a Fargate vCPU is just higher compared to EC2. An EC2 t3.small instance costs about 2 cents/hour and a similar configuration on Fargate costs about 9 cents/hour. For m6i.large and c6i.large instances, the disparity isn't as bad but it's still 15%-20% more expensive.
There are a few different reasons we're using Fargate. Like the other commenter mentioned, there's the lambda max run time. Our Fargate tasks also have a few sidecar containers running alongside the main services. The ECS Exec integration is also nice for poking around when things aren't working correctly.
Re: AWS GuardDuty – the Good, the Bad, and the Ugly
#40GuardDuty is another example of brilliance of AWS pricing scheme and how they manage to twist your hand to pay extra which can cost quite a lot in the end of the month. When comparing EC2 to servers, nobody adds the added premiums of the extras. Things like CloudTrail, Support, GuardDuty, CloudWatch. All of these things have a variable cost that grows with usage and very hard to predict ahead of time. Just last week…
Its quite annoying that you can't disable parts of guardduty you don't get much value from. I think the CloudTrail monitoring is quite useful and the VPC flowlog monitoring is basically useless (to me, I have other means of doing host and network based monitoring, I'm sure that there are a lot of people who get meaningful value out of it). I'd like to be able to turn off flowlog monitoring and just use guardduty for cloudtrail monitoring, but that isn't an option. So I can either overpay for a bunch of extra things I don't get any value from or not enable guardduty at all.