On October 8, 2026, Amazon Web Services announced an expansion of Amazon GuardDuty RDS Protection to identify data exfiltration and data destruction attacks targeting Amazon Aurora PostgreSQL and Amazon RDS for PostgreSQL databases.
Expanding Threat Detection
Amazon Web Services announced that Amazon GuardDuty RDS Protection now identifies data exfiltration and data destruction attacks targeting Amazon Aurora PostgreSQL and Amazon RDS for PostgreSQL databases. Called RDS Protection for data activity, the new capability uses machine learning-based anomaly detection and integrated threat intelligence.
According to AWS, the feature continuously monitors database query patterns to detect unusual activity without requiring any agents, additional infrastructure, or database configuration changes. It establishes behavioral baselines for normal query patterns to detect threats that traditional tools miss.
Availability and Enablement
The new capability is available today in all AWS commercial Regions and AWS GovCloud (US) Regions where Amazon GuardDuty RDS Protection is offered with support for Aurora PostgreSQL and Amazon RDS for PostgreSQL. AWS stated that a 30-day free trial is available per account per Region.
Users can enable GuardDuty RDS Protection for data activity as an add-on to RDS Protection for login activity. It can be turned on for an entire organization with a single click in the GuardDuty console, or programmatically via APIs, SDKs, CLI, or AWS CloudFormation.
What to do
- Enable GuardDuty RDS Protection for data activity as an add-on to RDS Protection for login activity.
- Turn it on with a single click for your entire organization in the GuardDuty console, or programmatically via APIs, SDKs, CLI, or AWS CloudFormation.
Key facts and where they come from
- Amazon GuardDuty RDS Protection now identifies data exfiltration and destruction attacks targeting PostgreSQL databases.
identify data exfiltration and data destruction attacks targeting Amazon Aurora PostgreSQL and Amazon RDS for PostgreSQL databases.
- The monitoring capability operates without requiring any agents, additional infrastructure, or database configuration changes.
without requiring any agents, additional infrastructure, or database configuration changes.
- A 30-day free trial is available for the new feature per account per Region.
A 30-day free trial is available per account per Region.