Amazon GuardDuty has expanded its RDS Protection capabilities to identify data exfiltration and destruction attacks targeting Amazon Aurora PostgreSQL and RDS for PostgreSQL. This new feature, available as RDS Protection for data activity, leverages machine learning and threat intelligence to monitor query patterns for anomalies. It operates without requiring agents, additional infrastructure, or database configuration changes, addressing threats that emerge after attackers gain valid credentials.
- Covers Aurora PostgreSQL and RDS for PostgreSQL, not MySQL or other engines.
- Detects exfiltration and destruction, expanding beyond previous login anomaly focus.
- Agentless deployment requires no infrastructure changes or DB config updates.
- Uses ML anomaly detection and integrated threat intelligence for continuous monitoring.
- Critical for defending against post-compromise data theft via valid credentials.
