since we are excluding security group in the lambda function, our config rule will always be non-compliant. If you don't want that then you need to create your own custom config rule