A company needs a native AWS solution to alert on repeated failed logins to its bastion hosts: trigger a notification when 5 failed authentication attempts occur within 5 minutes, and send the alert only to the system administrator responsible for the affected host. Which approach meets these requirements?

The correct approach uses the CloudWatch agent to send operating system logs (like auth.log or secure) to CloudWatch Logs. A CloudWatch metric filter then extracts failed login attempts, creating a custom metric. A CloudWatch alarm monitors this metric, triggering when 5 failed attempts occur within 5 minutes. This alarm publishes to an SNS topic. SNS message filtering allows you to route notifications to specific administrators based on attributes in the message (e.g., host ID), ensuring only the responsible admin is alerted. Incorrect options: Using EventBridge for alarms is not the primary mechanism; CloudWatch Alarms are designed for this. Using EC2 instance tags to decide which SNS topics receive notifications is less dynamic and scalable than SNS message filtering for per-host notifications. Systems Manager Agent collects logs but the Run Command document doesn't directly configure an EventBridge event for this purpose; CloudWatch Alarms are the correct service. While Systems Manager Agent can collect logs and Run Command can configure CloudWatch alarms, using EC2 instance tags to determine SNS topics is not as flexible as SNS message filtering for targeted notifications to a specific administrator.