Good points, I'm building an open source security lake platform for AWS (
https://github.com/matanolabs/matano) that lets you ingest petabytes of data and write detections as code, all in your AWS account. We take an IaaC approach so everything from config to detections is managed as code in Git.