A company observes unusual login attempts across many AWS accounts. An SNS topic already exists with the security team subscribed. Which approach requires the least operational effort to notify the security team when multiple failed Console login attempts occur?

The correct approach leverages existing AWS services for efficient monitoring and notification. CloudTrail management events capture ConsoleLogin attempts, and sending these to CloudWatch Logs allows for real-time analysis. A CloudWatch Logs metric filter can then specifically identify "failed ConsoleLogin" events. An alarm based on this metric directly publishes to the pre-existing SNS topic, minimizing operational overhead. Incorrect options: Sending CloudTrail logs to S3 and using Athena requires setting up and managing Athena queries and EventBridge rules for scheduling and error handling, which is more complex and operationally intensive than direct CloudWatch integration. CloudTrail data events track API activity on resources like S3 objects or Lambda functions, not Console login attempts, making this option unsuitable for the problem. Sending data events to S3 and using S3 event notifications is incorrect because Console login attempts are management events, not data events. Additionally, filtering for specific event content directly within S3 event notifications is limited.