A company must detect unauthenticated access attempts to its Amazon EKS clusters without making any configuration changes to the existing EKS deployments. Which solution provides this with the least operational effort?

Enabling Amazon GuardDuty with EKS Audit Log Monitoring is the correct solution because GuardDuty natively integrates with EKS audit logs to detect suspicious activity, including unauthenticated access attempts, without requiring any configuration changes to the EKS clusters themselves. This provides a fully managed, low-effort security monitoring solution. Installing a third-party EKS add-on would require configuration changes within the EKS clusters, violating the "no configuration changes" constraint. Enabling AWS Security Hub alone would aggregate findings but doesn't inherently provide the EKS audit log monitoring capability needed for this specific detection without an underlying service like GuardDuty. Monitoring CloudWatch Container Insights metrics focuses on performance and operational health, not security audit logs for unauthenticated access attempts.