Do EC2 Security groups operate on the instance or AWS network infrastructure, can it be DDOSed?

Hello.

Assuming someone knows the IP address (bypassing Cloudflare) of my EC2 instance and wants to launch a DDOS attack, does the security group consume my instance resources inside my VPC to drop these packets, or are they filtered on AWS infrastructure and my instance won't know if these were even dropped?

You can check the IP addresses rejected by ENI using VPC flow logs.
In other words, you can confirm that the security group associated with the ENI is working.
Therefore, if it is prevented by a security group, it will not be able to reach EC2, so even if a DDos occurs, the load on EC2 should not increase.
https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html

Obviously if I don't whitelist Cloudflare IP's, the end user would first reach the server (assuming they know the IP address) and the web server redirects them to the domain name passing through Cloudflare, so a DDOS on the IP address will consume instance resources, right?

As you know, if Cloudflare's IP address is not registered in the security group, it will be able to directly access EC2, so when a DDos occurs, the load on EC2 will increase.

Adding one detail which is not covered in the other answer:

Security Groups are an EC2 feature which works at the hypervisor level.

When allowing/denying traffic based on security group rules, the instance resources (primarily CPU here) are not impacted. So if you are only allowed traffic from the CloudFlare IP address range (and therefore denying all others); if there is traffic from an unwanted IP address it is blocked by the security group without using any CPU (or other) resources on the instance.

The instance (specifically the operating system you're running on the instance) does not know the packets are dropped because they are dropped by the hypervisor.