A company needs a solution to enforce data encryption at rest on Amazon EC2 instances. The solution must automatically identify noncompliant resources and enforce compliance policies on findings. Which solution will meet these requirements with the LEAST administrative overhead?

The correct solution combines preventative and detective/remediative measures with minimal overhead. An IAM policy preventing the creation of unencrypted EBS volumes is a strong preventative control. AWS Config is designed for continuous monitoring and evaluation of resource compliance against desired configurations, making it ideal for detecting noncompliant (unencrypted) EBS volumes. AWS Systems Manager Automation can then be used to automatically remediate these findings, such as encrypting existing unencrypted volumes or stopping non-compliant instances. Using AWS KMS alone doesn't enforce encryption creation, only manages keys. AWS Lambda and EventBridge can automate, but Config and Systems Manager are purpose-built for compliance and remediation. Amazon Macie focuses on sensitive data discovery, not EBS encryption enforcement. Amazon Inspector is for vulnerability management, not EBS encryption compliance.