The new RDS Protection for data activity uses machine learning to establish behavioral baselines of database query patterns, enabling detection of anomalies indicative of data theft or destruction even when attackers have valid credentials. This complements existing login anomaly detection in GuardDuty.
The capability applies to Amazon Aurora PostgreSQL and Amazon RDS for PostgreSQL, is agentless, and requires no changes to the database configuration. Administrators can enable it organization-wide via the GuardDuty console or APIs, with a 30-day free trial available. It helps organizations address evolving threats targeting critical database assets across supported AWS Regions.
Source & further reading
Amazon GuardDuty RDS Protection now detects data exfiltration and destruction in Aurora and RDS databases ↗Source published 2026-10-08. This report was prepared with AI assistance from the linked primary-source material. Claims and limitations should be checked against the original announcement or research.