Configuration for enabling GuardDuty threat detection **Cost Consideration:** GuardDuty charges are based on: - CloudTrail events analyzed - VPC Flow Logs analyzed - DNS logs analyzed Typical cost: $4-5 per million events **When to enable:** - Production environments with sensitive data - Compliance requirements (PCI-DSS, HIPAA) - Environments requiring threat detection **Note:** GuardDuty must be enabled via AWS Console or CLI, not CloudFormation Use this as documentation and manual setup guide