Hacker News Reader

Comment by tptacek | Hacker News Reader

The S3 data classification seems too expensive, but if the Cloudtrail stuff works, that seems pretty cheap for what you get.

View on HN

CloudTrail is indeed very cheap for customers — we record nearly all API calls and access to AWS resources and deliver these events to our subscribing customers. And the events are delivered for free, outside of S3 and Lambda “Data events” — gets, puts, and function invocation is billed at a very cheap rate.

(We recently released our AWS Lambda integration — you can now record all Lambda function invocations with us!)

Disclaimer: I’m a Software Engineer with the AWS CloudTrail team.

If I'm reading this right, you now have two paid services for detecting CT anomalies: Guard Duty, which is nosebleed expensive, and Macie, which is practically free. What's the difference between the two?

Macie Analayzes a subset of CloudTrail, not all actions and is about historical behavior (though for high sev actions, it is more point in time)

GuardDuty is looking for specific threats/attacks and can combine multiple sources of telemetry for more advanced correlation. E.g. A combination of VPC Flows + CloudTrail + DNS that trigger an alert when formed together while a single CloudTrail event may not have.

Within CT, what are examples of things Macie will catch, vs. things you'd need GD to catch?

If GD weren't so expensive, I wouldn't really care that much. But GD is so expensive that it can be hard to recommend, which is especially weird since the pricing for Macie CT is so low --- even weirder when you note that the pricing for Macie S3 is so high!

I found the pricing for Guard Duty reasonable compared to most IDS systems.

They let you turn on GuardDuty for free for 30 days and give you an estimate your bill so that helps.

I ran up a $20k+ Macie bill scanning 5 buckets in 24hrs.

What kinds of results did it generate?

A healthy amount of data that looked like PII based on data range, potential secrets in buckets, CSVs, JSONs, Cloudtrail dumps, but also generated reports on dummy data and without fingerprinting of the live data, it wouldn't know what's real or not. The Cloudtrail feature is also useful since it provides user behavior analytics, based on use, etc.

The CT stuff looks interesting, since it's inexpensive, and the other monitoring thing Amazon does (GuardDuty?) is expensive.

It's $4 per 1-million API calls processed. And starts at $1 per GB of logs processed.

Which pricing dimension is of concern?

Reply on news.ycombinator.com