A company runs container workloads on AWS App Runner and stores container images in Amazon ECR. The DevOps engineer must continuously monitor the ECR repository and automatically produce a new container image when an OS or language-package vulnerability is detected. Which solution satisfies this requirement?

The correct solution leverages EC2 Image Builder for automated image creation and Amazon Inspector for vulnerability detection. Enabling enhanced scanning on ECR with Inspector automatically identifies OS and language-package vulnerabilities. An EventBridge rule then captures these Inspector findings, triggering the Image Builder pipeline to rebuild the image with updated components, addressing the detected vulnerabilities. The rebuilt image is pushed back to ECR, ensuring continuous remediation. Incorrect options: GuardDuty Malware Protection focuses on runtime threats, not static image vulnerabilities, and wouldn't trigger a rebuild for OS/language package issues. Basic ECR scanning is less comprehensive than enhanced scanning (Inspector) and triggering on ECR image action events doesn't address vulnerability detection as the primary trigger. AWS Systems Manager Compliance scans EC2 instances (managed nodes), not container images in ECR, making it unsuitable for detecting vulnerabilities within the container image itself.