Rationalising Amazon WAF as an implementation of an IPS would be difficult as it is like rationalising a bicycle is a aeroplane because sometimes they both have tires on tar roads.. Analogies aside allow me to share my personal experiences as an information security consultant for the APAC regions AWS APN partner of the year specifically leading a few PCI DSS engagements myself:
Guard Duty is precisely the IDS the ROC describes, and to further convince a QSA you might decide to demonstrate the workflow you have applied around how you use Guard Duty because (again with an analogy) saying you use Guard Duty and not how you use it is the same as having a firewall device in the data centre not powered on and saying you 'have a firewall device', Guard Duty alone doesn't act much like what an IDS should unless you apply your process (technical or practical) to use Guard Duty as an IDS.
How should you use Guard Duty as an IDS?
- an IDS relies on it's sources of IOC (indicators of compromise) and the AWS Resource offers you an ability to add threat intelligence feeds in several standard formats. You can demonstrate to the QSA how you configured your own feeds with Guard Duty's cloudforamtion, terraform, ansible playbooks, CDK, or your ClickOps playbook with screenshots (whatever you use to do deployments of AWS Resource configurations)
- An IDS 'D' detects; Show the QSA examples of past alerts that arrived, how you triaged the alert for true positive (the alert indicates a threat that is proven to be real) and how you determined the threat, scored the risk, decided an outcome
- show how you used the IDS alert and remediated the threat, then tested and monitored the remediation you applied for proof it was an effective remediation for the detected threat (maybe you can just use the payload that triggered the alert to see if it triggers the alert again)
For an IPS you might need to find an alternative solution as AWS has no IPS offerings on their platform, though an AWS Proserve consultant will argue the AWS Network Firewall is an IPS because they have a feature they named "Managed IPS Rules" but naming a feature does not make the service as a whole somehow meet all the characteristics of an IPS.
If you must use AWS resources to achieve what an IPS achieves (and have the QSA include these as compensating controls in their CCW accompanying the ROC) you can try to show them how you use; AWS Shield Advanced, WAF, AWS Network Firewall, Systems Manager Documents to describe host based configurations that provide IPS capabilities (e.g.
fail2ban on Linux for SSH/FTP/etc. IPS)
Just remember that in PCI DSS 3.2.1 the QSA has complete discretion over what is compliant and what is not. You do not need to do anything described in the requirements and you can still be compliant according to the QSA. I have seen first hand the entire requirement 3 not be met (no encryption was ever used at all) and because the other data protections in place satisfied the QSA the entire requirement 3 was disregarded and the company was PCI DSS compliant. This is all due to the CCW, a QSA may evaluate anything you implement as being as good or better as the requirement, so strictly speaking you do not need an IPS or IDS at all, all you need to do is show you considered the intent of an IPS/IDS and addressed them in your architecture.