The company you are working for is prototyping a HIPAA-compliant application. You as a DevOps engineer have to automate the resource auditing process, including CIS AWS Foundations Benchmark requirements as an external compliance framework. The results have to be sent periodically as email notifications. Which statement is true when creating custom AWS Config rules via AWS Lambda function to model criteria meeting?

Answer options:

A.You develop custom rules and add them to AWS Config. Then, you can associate each custom rule with one out of the two AWS Lambda function blueprints only, which contains the predefined logic that evaluates whether your AWS resources comply with the rule. The Lambda function will require permission only to publish a message to Amazon SNS. The custom rule will require permission to query AWS Config.
B.You develop custom rules and add them to AWS Config. Then, you can associate each custom rule with any AWS Lambda function blueprints only, which contains the predefined logic that evaluates whether your AWS resources comply with the rule. The custom rule will require permission only to publish a message to Amazon SNS.
C.You develop custom rules and add them to AWS Config. Then, you associate each AWS Lambda function with a custom rule containing the logic that evaluates whether your AWS resources comply with the rule. The custom rule will require permission to query AWS Config and publish a message to Amazon SNS.
D.You develop custom rules and add them to AWS Config. Then, you associate each custom rule with an AWS Lambda function containing the logic that evaluates whether your AWS resources comply with the rule. The Lambda function will require permission to query AWS Config and publish a message to Amazon SNS.

Correct Answer: D
In order to create a custom rule that audits AWS resources for security compliance, you have to create and associate an AWS Lambda function with the evaluation logic that polls AWS Config for detection purposes. This scenario also requires additional permission to be able to publish messages to an Amazon SNS topic to manage email notifications.
Incorrect Answers:
Options A, B are incorrect because all the AWS Lambda function blueprint available are just a starting point to work on a template. But it is perfectly possible to create and use a custom function from scratch.
Option C is incorrect because the custom rule does not contain the evaluation logic. The AWS Lambda function is the one with the logic that audits AWS resources.
References:
https://go.aws/2zrEPlI
https://amzn.to/3fxPdch