Question

A CloudOps engineer manages AWS Config across an organization. A security requirement mandates that data at rest in Amazon RDS must be encrypted using a customer managed KMS key rather than the default AWS managed key. The team already has an AWS Config rule detecting unencrypted RDS instances, but they now need automatic email alerts to the security team whenever any resource is evaluated as NON_COMPLIANT, without writing custom evaluation logic. Which approach meets this requirement with the least operational effort?

Accepted Answer

Create an Amazon EventBridge rule that matches AWS Config compliance change events with a NON_COMPLIANT state and targets an Amazon SNS topic subscribed by the security team.

Answer

Enable an AWS Config conformance pack and configure it to send SMTP email directly to the security team's distribution list on each failed evaluation.

Answer

Write a Lambda function invoked on a schedule that calls the AWS Config API, filters NON_COMPLIANT resources, and sends email through Amazon SES.

Answer

Configure an Amazon CloudWatch alarm on the AWS Config compliance metric and set the alarm action to notify the security team via SNS.