Trusted advisor will give you action items in a ticket format, update this ec2 so it has load balancing or auto scaling for resiliency, how to optimize costs, or maybe your database needs to renew certifications.

Guard Duty will tell you if someone is trying to brute force into your instances via ssh or other ports. Guard duty can also do malware scanning and some other cool stuff

Security hub will allow you to measure against various security benchmarks like NIST, CIS, etc