A company's security team must approve every new IAM user. When a new IAM user is created, the user must have all access removed automatically and the security team must be notified to approve the user. The account already has a multi-Region CloudTrail trail. Which combination of steps will accomplish this? (Choose three.)

To automatically remove access and notify the security team when a new IAM user is created, an Amazon EventBridge rule is the correct starting point. EventBridge can monitor CloudTrail logs for the CreateUser API call by defining a pattern with detail-type as AWS API Call via CloudTrail and eventName as CreateUser. This rule can then trigger an AWS Step Functions state machine. A Step Functions state machine is suitable for orchestrating the multi-step process of removing access, as it can manage the workflow, including calling AWS Lambda functions to modify IAM policies. Finally, Amazon SNS is the appropriate service for notifying the security team, as it supports various subscription types (email, SMS, etc.) and can be easily integrated with EventBridge or Step Functions. Configuring CloudTrail to send notifications directly for CreateUser is not a standard or flexible way to trigger complex workflows like removing access. Invoking a container in Amazon ECS with Fargate for removing access is overly complex and expensive compared to a Step Functions workflow that can directly call AWS SDK actions or Lambda functions. Amazon Pinpoint is primarily for customer engagement and marketing communications, not for internal security notifications.