This article is based on AWS’s general availability announcement of Amazon Detective, originally reported via ZDNet (April 2020).
What Is Amazon Detective?
Amazon Detective is an AWS security service that automates the heavy lifting of security investigations. Rather than requiring analysts to manually collect, correlate, and visualize log data from multiple sources, Detective continuously ingests that data, applies machine learning and graph theory, and surfaces an interactive model showing how your AWS resources behave and interact with each other.
The service moved from preview—where it debuted at AWS re:Invent 2019—to general availability in early 2020. Its goal is to cut the time it takes to identify the root cause of a security alert from hours or days down to minutes.
The Problem It Solves
Security tools such as AWS Security Hub and Amazon GuardDuty are effective at detecting anomalies and raising alerts. The harder challenge is investigating those alerts: tracing an unexpected API call, an unusual login, or a spike in traffic back to its origin.
Traditionally, a security team investigating a cloud incident has to:
- Identify all relevant log sources (CloudTrail, VPC Flow Logs, GuardDuty findings, etc.).
- Extract and normalize potentially terabytes of log data.
- Build custom dashboards or queries to correlate events across those sources.
- Repeat the process iteratively as new leads emerge.
For smaller organizations, this process is often simply out of reach—they lack the staffing and tooling. For larger organizations, the sheer data volume becomes the bottleneck. Dan Plastina, then VP for security services at AWS, described the situation plainly at launch:
“Gathering the information necessary to conduct effective security investigations has traditionally been a burdensome process, which can put crucial in-depth analysis out of reach for smaller organizations, and strain resources for larger teams. Amazon Detective takes all of that extra work off the customer’s plate, allowing them to focus on finding the root cause of an issue and ensuring it doesn’t happen again.”
Dan Plastina, VP Security Services, AWS
How Amazon Detective Works
Data Sources
Amazon Detective automatically ingests and processes log data from three primary AWS sources:
- AWS CloudTrail – API call history across your AWS infrastructure.
- Amazon VPC Flow Logs – Network traffic metadata at the VPC level.
- Amazon GuardDuty findings – Threat intelligence and anomaly detections already raised by GuardDuty.
No manual log pipeline setup is required. Detective handles ingestion continuously, and retains up to one year of aggregated data to support historical analysis.
Graph-Based Behavioral Analysis
Detective applies machine learning, statistical analysis, and graph theory to the ingested data. The output is an interactive graph model that maps relationships between entities—IAM roles, EC2 instances, IP addresses, user accounts, and API calls—and shows how their behavior changes over time.
This behavioral baseline is what distinguishes a genuine threat from a false positive. For example, if GuardDuty flags an unusual ConsoleLogin API call, Detective can immediately surface:
- Historical trends for that API call over days or weeks.
- A geolocation map of login attempts associated with that user or role.
- Related IP addresses, AWS accounts, and resources linked to the finding.
Multi-Account Aggregation
Amazon Detective is designed for enterprise-scale environments. According to Sebastien Stormacq, senior developer advocate at Amazon, the service aggregates data from up to 1,000 AWS accounts into a single security-owned master account:
“It is a multi-account solution that aggregates data and findings from up to 1,000 AWS accounts into a single security-owned ‘master’ account, making it easy to view behavioral patterns and connections across your entire AWS environment.”
Sebastien Stormacq, Senior Developer Advocate, Amazon
This is particularly valuable for organizations using AWS Organizations or running separate accounts per business unit, environment, or product line.
Key Capabilities at a Glance
| Capability | Detail |
|---|---|
| Data retention | Up to 12 months of aggregated log data |
| Data sources | CloudTrail, VPC Flow Logs, GuardDuty findings |
| Analysis techniques | Machine learning, statistical analysis, graph theory |
| Multi-account support | Up to 1,000 AWS accounts per master account |
| Integration | Works alongside GuardDuty and AWS Security Hub |
| Pricing model | Pay per GB of data ingested; no flat service fee |
Pricing
AWS confirmed at launch that there is no additional service charge to enable Amazon Detective. Customers pay only for the volume of data ingested from CloudTrail logs, GuardDuty findings, and VPC Flow Logs. Organizations already ingesting these data sources for other purposes should review the cumulative cost impact, as Detective adds an additional consumer of that data.
Real-World Perspective
Chris Farris, who led public cloud security at WarnerMedia and participated in the early access program, highlighted benefits for both large and small teams:
“It does the hard work of aggregating and analyzing high-volume telemetry sources. Larger organizations will see major efficiencies, and small teams will have access to information and tooling that they’d have a hard time collecting and building on their own.”
Chris Farris, Head of Public Cloud Security, WarnerMedia
Who Should Use Amazon Detective?
Amazon Detective is a strong fit for any organization running workloads on AWS that needs to investigate security alerts faster and with less manual effort. Specific use cases include:
- Security operations centers (SOCs) that triage GuardDuty findings at scale.
- Small security teams that cannot build and maintain custom log aggregation pipelines.
- Multi-account AWS environments where cross-account correlation is otherwise complex.
- Incident response teams needing rapid root-cause analysis with historical context.
If your organization already uses GuardDuty and CloudTrail—both of which are AWS best-practice recommendations—enabling Detective adds significant investigative depth with minimal additional configuration.
Summary
Amazon Detective addresses one of the most time-consuming tasks in cloud security: turning a raw alert into a confirmed finding with a clear chain of evidence. By automating log aggregation, applying graph-based behavioral analysis, and retaining a year of data across up to 1,000 accounts, Detective brings enterprise-grade investigative capability to organizations of all sizes—without requiring them to build the underlying data infrastructure themselves.
For teams already invested in the AWS security ecosystem, it is a logical complement to GuardDuty and Security Hub, shifting focus from detecting problems to understanding them.