MS Defender Antivirus on Windows EC2 is included without additional cost?

Microsoft Defender Antivirus is not included by default without additional cost on Windows EC2 instances. The Windows Server license that comes with EC2 instances does not include Microsoft Defender Antivirus as a free, permanent feature.

For malware protection on EC2 instances, AWS offers its own solution called GuardDuty Malware Protection. This service scans EBS volume snapshots for malware without requiring the installation of any agents on your EC2 instances. GuardDuty Malware Protection is priced separately, typically at around $0.03 per GB scanned, depending on the region.

If you see Microsoft Defender Antivirus enabled on your Windows EC2 instance, it may be part of a trial period or a specific Windows Server edition that includes it temporarily. However, for long-term, comprehensive malware protection on EC2, it's recommended to use AWS-native solutions like GuardDuty or consider third-party antivirus solutions compatible with EC2 instances.

It's important to note that while Windows EC2 instances come with certain Microsoft licenses included (such as the Windows Server license itself and two Remote Desktop Services licenses for administrative purposes), additional Microsoft security products like Defender Antivirus are not typically included in this licensing model.
Sources
EC2 Malware protection question | AWS re:Post
Microsoft Licensing
Pricing in GuardDuty - Amazon GuardDuty