A security team must record resource configurations, detect issues, and receive notifications. The account runs an EC2 Auto Scaling group that scales frequently. The team needs notification within 2 days if any EC2 security group allows 0.0.0.0/0 on port 22, and routine snapshots of resource configuration. An SNS topic already exists and the team is subscribed. Which solution satisfies these requirements?

The correct solution uses AWS Config with configuration-change recording, which is ideal for frequently changing resources like Auto Scaling groups, ensuring all changes are captured. The ssh-restricted managed rule specifically checks for security groups allowing unrestricted SSH (port 22 from 0.0.0.0/0), directly addressing the security team's requirement. Integrating with an existing SNS topic provides the necessary notification mechanism. Incorrect options: "Periodic recording" might miss transient violations in a frequently scaling environment. The vpc-sg-port-restriction-check rule is more general and doesn't specifically target SSH. The vpc-sg-open-only-to-authorized-ports rule is not the most precise for the specific SSH port 22 requirement. A custom Lambda function, while possible, is less efficient than using a managed AWS Config rule, which is designed for this exact purpose and integrates seamlessly with configuration recording and notifications. The 2-day notification requirement also makes a daily Lambda run potentially too slow if the change happens just after a run.