I've set up Suricata (similar to snort in many ways) on AWS, and it was a pretty horrible process.

Basically what you need to do is set up VPC-Mirroring on every single interface in that VPC and send all the traffic to an endpoint attached to your snort server.

https://docs.aws.amazon.com/vpc/latest/mirroring/what-is-tra...

It's a ton of work, and is quite expensive, since you're paying per interface + per traffic.

A better way to handle it (imo) is to just enable VPC flow logging and pull the cloudwatch stream into your SIEM. Suricata/snort isn't that useful for threat detection anymore (thanks to HTTPS), so the important data to capture is just firewall logs.

You can still have suricata/snort, but you have to be more selective with it.

AWS is a totally different beast and you'll have other useful tools in the stack there. Cloud trail, guard duty, VPCs, proper least privilege and IAM rules, etc. What are you looking for in a snort alternative? It is the open source standard; though you might also look at suricata. Perhaps a whole security stack like security onion which incorporates snort and a lot of other tools. Might be overkill for what you want though.

Not sure about the AWS bit but I like Suricata.

check this https://aws.amazon.com/marketplace/pp/prodview-mn63yjbq37n4c it is expensive, but for large company with good infosec budget it is worth every penny

AWS network firewall loaded with suricata rules?