A company requires that all cloud resources be deployed with CloudFormation and wants immediate notifications to the security team if an IAM role is created outside CloudFormation. An SNS topic exists with the security team's email subscribed. Which solution will send immediate notifications when a role is created without CloudFormation?

The correct solution uses Amazon EventBridge to directly monitor CloudTrail events. EventBridge can filter for specific CloudTrail events, such as IAM role creation (CreateRole), and then check the userIdentity.invokedBy field to ensure it's not cloudformation.amazonaws.com. If a match occurs, EventBridge can immediately send a notification to the specified SNS topic. This provides real-time detection and notification without polling. The other options involve polling CloudTrail at intervals (e.g., every 15 minutes), which introduces a delay in detection and notification. Additionally, they require managing compute resources (Lambda, Fargate, EC2) and custom code for filtering, making them more complex and less efficient than a native EventBridge rule for this specific use case.