Bugfix for CIS 3.1-3.14

[mobri2a]

Issue #, if available: 38, 43

Description of changes:

• Corrected permissions on the sns topic for local remediation notifications to allow principal cloudwatch.amazonaws.com
• Corrected permissions on the kms cmk used to encrypt the topic to allow same
• Changed alarm period to 1 in 12 from 1 in 240. Alarms now assert on the first occurrence in an hour, and reset when no occurrences for one hour.

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.