AWS Security Hub
AWS Security Hub provides a compact view of your security posture within AWS. You can use it to run automated checks and prioritize and remediate security issues. The security hub can utilize multiple different security standards such as Center for Internet Security (CIS), or, if you're in the banking industry, Payment Card Industry Data Security Standard (PCI DSS), or, even more broadly, the National Institute of Standards and Technology (NIST). (Repeat after me, "We love NIST 800-53, we love NIST 800-53...")
In addition to supporting multiple standards, AWS Security Hub can also receive findings from other AWS services such as Config, GuardDuty, Inspector, and Macie. Now, what do you do with those findings? How do you get alerted? Luckily, as always, AWS has thought of that. You can utilize the Security Hub to send the findings to the AWS Audit Manager or to AWS Chatbot which can send a message to Teams or Slack or whatever your messaging service.
AWS CloudWatch
AWS CloudWatch is your first stop for monitoring your AWS resources. It is a repository that collects different metrics and logs from AWS resources. CloudWatch has alarm features, correlation features, and various dashboards to view your data quickly. CloudWatch can alert you when, say, your super duper software goes rogue and decides to use 100% of your EC2 instance's CPU. Oh, yours doesn't do that? Well, clearly you're the superior programmer. Anyway, for those of us with less than perfect programming skills, CloudWatch can be beneficial to ensure your AWS resources don't go rogue.
AWS GuardDuty
Amazon GuardDuty is a machine learning (See xkcd 1838) backed threat detection service. When you set it up, you leave it running for a week or so and it builds a baseline of expected activity for your environment. Behind the scenes, GuardDuty uses VPC Flow Logs (network traffic logging), DNS Logs, CloudTrail, and S3 events.
Of course, there are elements you should trust inherently, such as a scanner running on your infrastructure. For this reason, you can add trusted IPs. Conversely, if you have a known threat, you can add an IP as an untrusted IP. Even further, GuardDuty has a malware detector that can detect malware on your EC2 instances.
Amazon Inspector
Amazon Inspector is a vulnerability management service that continually scans your AWS resources such as EC2 instances, containers in the ECR (Elastic Container Registry), and Amazon Machine Images (AMIs). It scans for CVEs and unintended network exposure. Because who hasn't created an EC2 instance that you couldn't access, so you just configured a 0.0.0.0/0 inbound rule, and voila! Access! Oh, wait...that opened it up to the entire web! Amazon Inspector catches those things and more.
AWS IoT Device Defender
AWS IoT Device Defender helps you audit configurations, detect anomalies, and authenticate your IoT (Internet of Things) devices. Like all other AWS services, it will send alerts based on findings. It audits those resources based on security best practices. It has a couple of detection methods such as rules-based detection and machine learning based detection. Machine learning based detection checks metrics such as packet count, number of messages sent, authorization attempts, etc.