My only experience with GuardDuty was when Security unilaterally rolled it out, and it promptly began eating CPU in ECS containers. Unfortunately, this included PgBouncer, and their throughput plummeted.

Took a while to figure that one out, not least of which because ECS has absurdly shitty UX, with little to no observability.