A compliance officer at a financial services company needs to continuously assess, audit, and evaluate the configurations of AWS resources over time. Specifically, they want to see a history of how a security group's rules have changed and be alerted when a resource drifts from a desired configuration. Which AWS service should they use?