Typescript 了解AWS配置规则和配置更改

我目前正在使用aws cdk，我的任务是为15个左右的规则创建配置规则，我们希望在这些规则上观看和接收通知。以下是我的代码供参考：

 const vpcFlowLoggingBucket = new s3.Bucket(this,'vpcFlowLoggingBucket', {
              accessControl:s3.BucketAccessControl.LOG_DELIVERY_WRITE
      
            });
            const generalConfigRole = new iam.Role(this,  'generalConfigRole',{
              assumedBy: new iam.ServicePrincipal('config.amazonaws.com')
            });

            const cloudTrailEnabledRule = new ManagedRule(this, 'cloudTrailEnabledRule', {
              identifier: 'CLOUD_TRAIL_ENABLED'
            });
            const  iamPasswordPolicyRule = new ManagedRule(this, 'iamPasswordPolicyRule',{
              identifier: 'IAM_PASSWORD_POLICY'
            });
            const userGroupMembershipRule = new ManagedRule(this, 'userGroupMembershipRule',{
              identifier: 'IAM_USER_GROUP_MEMBERSHIP_CHECK'
            });

            const userPolicyRule = new ManagedRule(this,'userPolicyRule',{
              identifier: 'IAM_USER_NO_POLICIES_CHECK'
            });
            const rootAccountMfaEnabledRule = new ManagedRule(this, 'rootAccountMfaEnabledRule',{
              identifier: 'ROOT_ACCOUNT_MFA_ENABLED'
            });
            const accessKeysRotatedRule = new ManagedRule(this, 'accessKeysRotatedRule',{
              identifier:'ACCESS_KEYS_ROTATED',
              inputParameters: {
                maxAccessKeyAge: 100, //rule triggers off of config change and keys must be rotated within 100 days
                configurationChanges: true
              }

              //TODO reference your custom lambda for this
              //Parameters need to be specified here for the amount of days to rotate
            });
            const cloudTrailEncryptionRule = new ManagedRule(this, 'cloudTrailEncryptionRule' ,{
              identifier:'CLOUD_TRAIL_ENCRYPTION_ENABLED'
            });
            const defaultSecurityGroupEniRule = new ManagedRule(this, 'defaultSecurityGroupEniRule',{
              identifier:'EC2_SECURITY_GROUP_ATTACHED_TO_ENI'
            });

            const ebsVolumeEncryption = new ManagedRule(this, 'ebsVolumeEncryption',{
              identifier:'EC2_EBS_ENCRYPTION_BY_DEFAULT'
            });
            const rdsStorageEncryptionRule = new ManagedRule(this, 'rdsStorageEncryptionRule',{
              identifier: 'RDS_STORAGE_ENCRYPTED'
              //This may need the arn of the kms key used for encryption
            });

            const s3BucketLoggingEnabledRule = new ManagedRule(this, 's3BucketLoggingEnabledRule',{
              identifier: 'S3_BUCKET_LOGGING_ENABLED'
              //@aroesec may be able to use a custom rule here for this one and my lambda
            // TODO add custom lambda to this for future purposes
            });
            const s3BucketServerSideEncryptionRule = new ManagedRule(this, 's3BucketServerSideEncryptionRule',{
              identifier:'S3_BUCKET_SERVER_SIDE_ENCRYPTION_ENABLED'
              //@aroesec may be able to use a custom rule here for my lambda
            // TODO add custom lambda to this for future purposes
            });

            const vpcFlowLogsEnabledRule = new ManagedRule(this, 'vpcFlowLogsEnabledRule',{
              identifier:'VPC_FLOW_LOGS_ENABLED',
              inputParameters: {
                trafficType:'ALL', //vpcs must track all traffic (ALLOW and DENY) with this rule
                configurationChanges: true
              }
            });

            const vpcDefaultSecurityGroupRule = new ManagedRule(this, 'vpcDefaultSecurityGroupRule',{
              identifier:'VPC_DEFAULT_SECURITY_GROUP_CLOSED'
            });

            const mfaEnabledForConsoleAccessRule = new ManagedRule(this, 'mfaEnabledForConsoleAccessRule',{
              identifier: 'MFA_ENABLED_FOR_IAM_CONSOLE_ACCESS'
            });

            const rdsMultiAvailZoneRule = new ManagedRule(this, 'rdsMultiAvailZoneRule',{
              identifier:'RDS_MULTI_AZ_SUPPORT'
            });
          }

        }

我的问题是，当我尝试使用configurationChanges参数并将其设置为True时。我正在寻找配置规则，以便在资源组注意到更改时扫描该资源组。我之所以要这样做而不使用“频率”参数，是因为我们的客户不希望扫描频率达到24小时。他们希望对每一条规则都进行2周左右的扫描。我的问题是，1。我是否可以使配置规则的扫描频率低于24小时？比如说，也许每周？2.我可以让lambda触发配置规则进行扫描吗？例如，让lambda检查vpc流日志，如果没有，则触发配置规则返回“不符合”。或3。我可以为每个配置规则将configurationChange设置为true，然后让aws从那里处理它吗？我问这个特定的问题是因为我读过一些关于config recorder的文章，但不确定如何使用它，或者它是否必要。提前谢谢大家

配置规则扫描的最低频率为24小时，不低于检查boto3 API时的频率

您可能希望相反，定期或在配置更改时运行配置规则

AWS不知道该处理什么。如果您进行配置更改，您的API或代码（通过lambda）需要知道要检查什么（即bucket对公众开放），然后当检测到公共bucket时，lambda将捕获它并报告（PutEvaluationAP）