A company runs an application on Amazon EKS and distributes it via Amazon CloudFront. AWS WAF is enabled and WAF logs are sent to a CloudWatch Logs log group named aws-waf-logs. The company wants alerts only when there are sudden changes in blocked traffic, not for other WAF log variations. WAF rules will be tuned over time. The DevOps engineer is subscribed to an existing SNS topic. Which solution satisfies these requirements?

The correct solution leverages CloudWatch anomaly detection, which is designed to identify unusual patterns in metrics, rather than relying on static thresholds. By creating a metric filter for "blocked requests" from the WAF logs, a custom metric is generated. CloudWatch anomaly detection then learns the normal behavior of this metric and can trigger an alarm when significant deviations occur, fulfilling the requirement for alerts on "sudden changes in blocked traffic." This approach is superior to static thresholds, which would require constant adjustment as WAF rules are tuned. The incorrect options either use static thresholds, which are not suitable for dynamic WAF rule tuning, or apply anomaly detection to the entire log group rather than specifically to blocked requests, which would generate alerts for other WAF log variations.