Chapter 8: Hardening the Security of Your AWS Environment

1. Before starting to build your infrastructure, it is strongly recommended that you lock in your root account (that is, the account bound to your registration email). Then, create IAM users and groups with the necessary privileges, and use MFA (instead of just usernames and passwords) for root and IAM users.
2. You should enable CloudTrail for registering IAM users and role actions, and VPC Flow Logs for monitoring and logging network traffic. 
3. No; there is also WAF, an application firewall that works at level 7 of the TPC/IP protocol. 
4. You have to follow some best practices to configure your application, expose the least possible surface of the app to the internet and scale up and down. There are also WAF rate rules that help to limit malicious DDoS attacks.
5. In theory, you can, but it is convenient...