Exam AWS Certified SysOps Administrator - Associate topic 1 question 188 discussion

maintain a documented trail of any changes = config + S3 Notification = SNS

Option C provides a solution using AWS Config to record security group changes and notify the SysOps administrator: C. Set up AWS Config to record security group changes. Specify an Amazon S3 bucket as the location for configuration snapshots and history files. Create an Amazon Simple Notification Service (Amazon SNS) topic for notifications about configuration changes. Subscribe the SysOps administrator’s email address to the SNS topic. AWS Config can be configured to capture configuration changes, including changes to security groups. The configuration snapshots and history files can be stored in an Amazon S3 bucket. An Amazon SNS topic can be created to send notifications about configuration changes. The SysOps administrator can subscribe their email address to the SNS topic to receive notifications whenever security group changes occur.

AWS Config, a fully managed service that provides you with an AWS resource inventory, configuration history, and configuration change notifications to help enable security and governance. You can create AWS Config rules that automatically check the configuration of AWS resources that are recorded by AWS Config. For this example, I use a Config rule that is invoked whenever a change is made to a security group. Attach the Config rule to an AWS Lambda function that examines the ingress rules of a security group to see if the group remains in compliance with the rules.

https://aws.amazon.com/blogs/security/how-to-monitor-aws-account-configuration-changes-and-api-calls-to-amazon-ec2-security-groups/