AWS Control Tower generated aws-controltower-AggregateSecurityNotifications Config Rules Compliance Change SNS email notification may cause an excessive amount of emails reporting both COMPLIANT and NON_COMPLIANT notifications.

The COMPLIANT notifications can be filtered out using a SNS Subscription Filter Policy.

From the AWS SNS console in the account producing the alerts:
- Select Subscriptions
- Select the subscription with the topic aws-controltower-SecurityNotifications
- Click Edit
- Enable Subscription filter policy
- Select the Message body radio button
- Enter the Subscription filter policy below and click Save changes

{
    "detail": {
        "newEvaluationResult": {
            "complianceType": [
                "NON_COMPLIANT"
            ]
        }
    }
}

Amazon SNS example filter policies
https://docs.aws.amazon.com/sns/latest/dg/example-filter-policies.html