On a normal server, I would have fail2ban handle intrusion detection; how would I go about setting up IDS/IPS on AWS? Any help or pointers would be appreciated.
There are a few systems available through AWS - see https://aws.amazon.com/mp/scenarios/security/ids/ (if that link doesn't work, just Google "intrusion prevention system aws"). I found one account of someone who claimed to have looked at "virtually all the options" and settled on Alert Logic Threat Manager with ActiveWatch: https://www.quora.com/What-is-the-best-intrusion-detection-solution-for-solutions-hosted-in-AWS
Did you find a good solution yourself? Could you add an answer describing what you ended up doing, please?