Enable AWS Trusted Advisor and show the Security team that the Security Groups unrestricted access check will alarm.

Schedule an AWS Lambda function to run hourly to scan and evaluate all security groups, and send a report to the Security team.

Use AWS Config to enable the restricted-common-ports rule, and add port 80 to the parameters.

Use Amazon Inspector to evaluate the security groups during scans, and send the completed reports to the Security team.

Create an Amazon CloudWatch Events for file restoration from Amazon S3 Glacier using the GlacierJobDescrbption API and send the event to an SNS topic the administrator has subscribed to.

Create an AWS Lambda function that perform a HEAD request on the object being restored and checks the storage class of the object. Then send a notification to an SNS topic the administrator has subscribed to when the storage class changes to STANDARD.

Enable an Amazon S3 event notification for the s3: ObjectCreated : Post event that a sends notification to an SNS topic the administrator has subscribed.

Enable S3 event notification for the S3: ObjectRestore: Completed event that sends a notification to an SNS topic the Administrator has subscribed to.

Copy an automated RDS snapshot to the security account using the copy-db-snapshot command with the AWS CLI.

Create an RDS MySQL Read Replica for the critical database in the security account, then enable automatic backups for the Read Replica.

Create an RDS snapshot with the AWS CLI create-db-snapshot command, share it with the security account, then create a copy of the shared snapshot in the security account.

Use AWS DMS to replicate data from the critical database to another RDS MySQL instance in the security account, then use an automated backup for the RDS instance.