So this could be a good use case for CloudWatch Alarms with Anomaly Detection. Since Anomaly Detection uses a band instead of a set value so if something is really out of the ordinary you would get alerted and could automate remediation like a Honeypot.