GuardDuty RDS Protection adds ML-based data exfiltration and destruction detection

Fri, 09 Oct 2026 17:15:30 +0000

Platform/SRE — Plan: New GA capability for Aurora PostgreSQL and RDS for PostgreSQL that detects post-credential-compromise data exfiltration and destruction with no agent or config changes required; platform teams running RDS/Aurora should evaluate enabling the add-on for their organization this quarter via the GuardDuty console or CloudFormation.
CI/CD — Skip
Leader — Learn: GuardDuty now extends RDS threat detection beyond login anomalies to query-pattern behavior using ML, relevant for understanding current AWS-native security coverage breadth — no strategic decision or policy change is immediately required.

Rds-Protection on CuraDevOps