A banking firm has an application that must reach only specific public IP addresses from a VPC. A route table for the application's subnet has routes to those public IPs via an internet gateway. The engineer needs email alerts when someone adds a default route in that subnet's route table that points to the internet gateway. Which solution requires the LEAST implementation effort?

The correct solution leverages the no-unrestricted-route-to-igw AWS Config managed rule, which is specifically designed to detect unrestricted routes (0.0.0.0/0 or ::/0) to an Internet Gateway. This rule automates the detection process. Integrating it with Amazon EventBridge allows you to trigger an Amazon SNS notification when the rule identifies a non-compliant route, thus sending an email alert with minimal custom development. The Lambda function options require writing and maintaining custom code to poll or react to API calls, which is more effort than using a pre-built Config rule. The internet-gateway-authorized-vpc-only rule is not relevant here as it checks if an Internet Gateway is attached to an authorized VPC, not for specific route configurations.