Security gap: no GuardDuty (cloud behavioral threat detection) — deferred (cost)

[dubbytv]

Security gap: no AWS GuardDuty (cloud-level behavioral threat detection). From the Security Model gaps register — part of the security posture gap register epic #1152.

The gap

The platform has strong cloud-level isolation (separate accounts, SCPs, least-privilege IAM, KMS) but no cloud-native threat detection. GuardDuty is the AWS-native behavioral detector — it analyzes CloudTrail management events, VPC flow logs, and DNS logs (plus optional EKS Audit Log, S3, Malware, and RDS protection) for anomalous/malicious patterns (credential exfil, crypto-mining, recon, impossible-travel API calls, known-bad IPs).

This is one leg of the platform's biggest structural weakness: prevention-strong, detection-weak. The others being addressed in parallel — Falco (#149, cluster runtime detection), EKS audit logging (#816, forensics), SIEM (#1150, correlation).

Why deferred (cost)

GuardDuty pricing is usage-based and scales with event/log volume across all accounts; with EKS Runtime Monitoring and the org-wide multi-account footprint it can reach hundreds of $/month with no fixed cap. That conflicts with the platform FinOps posture (ADR-092: free OSS/native only, no spend budget; paid tiers documented-but-deferred).

Partial mitigation that reduces the urgency: Falco (#149, free/OSS) covers a meaningful slice of the runtime detection need on-cluster, and CloudTrail already provides the audit substrate. GuardDuty remains the right long-term cloud-detection layer but is deferred until there's a security budget (or a compliance driver that justifies the spend).

Scope when picked up

• Org-level GuardDuty via the management/delegated-admin account, auto-enrolling all member accounts.
• Decide protection plans by cost/value: management-event + flow-log + DNS baseline first; EKS Runtime Monitoring, Malware, S3, RDS protection as explicit cost-gated add-ons.
• Findings → the detection/response pipeline (SIEM Security gap: no centralized security-event aggregation (SIEM) #1150 / observability / owner-routing).

Blocked on: a security spend budget. Tracking: #1152.