A company's DevOps team manages multiple AWS accounts within an AWS Organizations organization. They need to ensure every Amazon EC2 instance uses only AMIs that the DevOps team approves and to automatically remediate any instances launched from unapproved AMIs. Individual account administrators must not be able to remove this restriction. Which solution meets these requirements?

The correct solution uses AWS Config conformance packs deployed organization-wide. This ensures that the approved-amis-by-id managed rule is enforced across all accounts, preventing individual account administrators from removing the restriction. Conformance packs provide a way to deploy and manage a collection of AWS Config rules and remediation actions consistently across an organization. Configuring the rule to run the AWS-StopEC2Instance Systems Manager Automation runbook automatically remediates noncompliant instances by stopping them. Incorrect options: Using CloudFormation StackSets with an EventBridge rule and SNS topic only provides notifications, not automatic remediation or enforcement that cannot be bypassed by account administrators. Deploying the approved-amis-by-id rule via StackSets would allow individual account administrators to potentially modify or disable the rule, failing to meet the requirement that they cannot remove the restriction. A Lambda function processing CloudTrail events and sending SNS notifications also lacks automatic remediation and organization-wide, unmodifiable enforcement.