Guard duty is a service you have to use. And you can configure it. So my initial claim is still valid that aws is not scanning by default 😂