A company requires that no Amazon EC2 security group allows SSH access from 0.0.0.0/0. The company wants continuous compliance monitoring and near-real-time notifications if any security group becomes noncompliant. A security engineer has enabled AWS Config with the restricted-ssh managed rule. What should the engineer do next to meet these requirements?

The correct answer leverages EventBridge to react to AWS Config compliance changes in near real-time. AWS Config emits events to EventBridge when a resource's compliance status changes. An EventBridge rule can be configured to specifically filter for compliance changes related to the restricted-ssh managed rule and then trigger an SNS topic for immediate notification. Option 1 is inefficient and complex. Parsing S3 snapshots for compliance changes is not a near real-time solution and requires significant custom development. Option 3 is overly complex. While CloudWatch Logs can receive Config notifications, creating metric filters and alarms adds unnecessary layers when EventBridge can directly process the compliance change event. Option 4 is incorrect because there isn't a direct CloudWatch metric for the compliance state of specific AWS Config rules that can be used to trigger an alarm in this manner. Compliance changes are best handled via EventBridge events from AWS Config.