A company policy mandates that every EC2 instance must include a defined set of tags; instances missing the required tags must be terminated automatically. What is the MOST operationally efficient way to implement this requirement?

The most operationally efficient solution is to use an AWS Config rule. AWS Config continuously monitors resource compliance against defined rules, making it ideal for enforcing tagging policies. When a noncompliant instance is detected (missing required tags), the Config rule can trigger a Systems Manager Automation document. This document can then be configured to automatically terminate the noncompliant instance, providing a fully automated and scalable solution. Incorrect options: An EventBridge rule forwarding state-change events to Lambda would require custom logic to check tags and would only trigger on state changes, not continuous compliance. IAM policies enforce permissions, not resource termination based on missing tags. They control who can do what, not what happens to resources based on their configuration. A scheduled Lambda function running every 5 minutes is less efficient than AWS Config's continuous monitoring and event-driven approach. It also requires more custom code for the tag check and termination logic.