A company prohibits use of the root user. The security team needs immediate alerts whenever root credentials are used to sign in to the AWS Management Console. How should the team accomplish this?

The correct answer is to use Amazon EventBridge to detect console login events and route them to Amazon SNS. EventBridge can be configured with a rule that matches specific CloudTrail events, such as ConsoleLogin where the userIdentity.type is Root. This allows for real-time detection and immediate notification via SNS. Using AWS Lambda to periodically query CloudTrail is less efficient and introduces latency, as it relies on polling rather than real-time event detection. Amazon Athena is a query service for analyzing data in Amazon S3 and is not designed for real-time event monitoring and alerting. AWS IAM Identity Center (formerly AWS SSO) logs are not the primary source for root user console login events across an AWS account; CloudTrail is. AWS Resource Access Manager (RAM) is used for sharing resources between AWS accounts and does not provide access log review or alerting capabilities.