Which solution will meet this requirement with the LEAST operational overhead?
Configure an RDS event notification subscription for DB security group events.
Create an AWS Lambda function that monitors DB security group changes. Create an Amazon Simple Notification Service (Amazon SNS) topic for notification.
Turn on AWS CloudTrail. Configure notifications for the detection of changes to DB security groups.
Configure an Amazon CloudWatch alarm for RDS metrics about changes to DB security groups.
Explanations:
RDS event notification subscriptions allow for near-real-time notifications when changes are made to RDS DB security groups with minimal setup and operational overhead.
While AWS Lambda and SNS can monitor DB security group changes, this solution adds unnecessary complexity compared to option A, involving custom coding and additional resources.
CloudTrail can track changes, but configuring notifications directly for DB security group changes requires additional steps and may introduce more complexity than option A.
CloudWatch alarms are designed for monitoring metrics, not specifically for tracking changes to DB security groups. This approach would not directly meet the requirements.
I sort that the answer is:
Configure an RDS event notification subscription for DB security group events.