# Amazon GuardDuty adds data exfiltration detection for PostgreSQL databases

> GuardDuty now flags abnormal query activity that could indicate data theft or deletion in Aurora and RDS PostgreSQL, with a free 30‑day trial.

Oossa · 2026-10-09 · https://oossa.com/en/amazon-guardduty-adds-data-exfiltration-detection-for-postgresql-databases

Amazon GuardDuty announced an expansion of its RDS Protection feature. The new add‑on watches query patterns in Aurora PostgreSQL and Amazon RDS for PostgreSQL. It uses machine‑learning‑based anomaly detection and threat intelligence, and it works without extra agents or config changes. Customers can turn it on with one click in the GuardDuty console or via API, and a 30‑day free trial is offered per account per Region.

## The facts

- Available in all AWS commercial and GovCloud (US) Regions as of Oct 8, 2026
- 30‑day free trial per account per Region

## Why it matters

It lets organizations spot hidden data‑theft or wipe attempts even when attackers have legitimate credentials.

## Sources & references

1. [Amazon GuardDuty RDS Protection now detects data exfiltration and destruction in Aurora and RDS databases](https://aws.amazon.com/about-aws/whats-new/2026/10/guardduty-rds-data-exfiltration/) – AWS, 2026-10-08

Last updated: 2026-10-09