New Blog | How to better manage cost of API calls that Defender for Cloud makes to AWS

By Bojan Magusic (HE/HIM)

 

Introduction:  

Have you ever found yourself in a situation where you enabled GuardDuty or CloudTrail on Amazon Web Service (AWS) and onboarded your AWS environment to Microsoft Defender for Cloud? Have you ever wondered how to minimize costs in AWS associated with having GuardDuty  or CloudTrail enabled, while Defender for Cloud makes API calls to your AWS environment?

 

This article teaches you how to implement proven best practices to ensure you optimize costs if you want to onboard your AWS environment to Defender for Cloud, while having GuardDuty or CloudTrail on AWS enabled.

 

Just to remind you that after you onboard your AWS environment to Defender for Cloud, Defender for Cloud periodically makes API calls to your AWS environment. The reason for Defender for Cloud making these API calls includes discovery of new resources that have been deployed to AWS, detection of new misconfigurations on your resources, remediation actions that might have been performed, etc.

For general guidance on how to onboard your AWS environment to Defender for Cloud, you can start at https://learn.microsoft.com/en-us/azure/defender-for-cloud/quickstart-onboard-aws. 

 

Imagine if you have GuardDuty or CloudTrail  enabled and Defender for Cloud makes API calls to your AWS environment. Due to GuardDuty or CloudTrail logs being enabled, this can incur cost on the AWS side. To minimize this cost, while having CloudTrail enabled, you can leverage the following capabilities:

• Scan interval
• Region selection   

 

These capabilities can be used individually or together depending on your use cases. To start with, I teach you how to use the scan interval to optimize costs on AWS.

 

When onboarding your AWS environment to Defender for Cloud, one of the configuration settings is called scan interval (figure 1). While the focus of this article is AWS, the scan interval setting is also available when onboarding your GCP environment to Defender for Cloud.

 

Have you ever wondered if it’s possible to adjust how often Defender for Cloud makes API calls to your AWS environment? With scan interval you can configure this to a value ranging from one hour (minimum) to 24 hours (maximum). Some resources types, albeit are excluded from the scan interval. The list of excluded resource types is available at:

 

 

Figure 1: Scan interval feature

 

Read the full post here: How to better manage cost of API calls that Defender for Cloud makes to AWS