A company stores container images in Amazon Elastic Container Registry (Amazon ECR). Each new image version receives a unique tag. The company needs an automated process that scans newly pushed images for common vulnerabilities and exposures (CVEs), automatically deletes image tags that have Critical or High severity findings, and notifies the development team when such deletions occur. Which solution satisfies these requirements?

The correct solution leverages ECR's scan-on-push feature for immediate vulnerability detection. EventBridge can directly react to the ECR Image Scan event, specifically filtering for CRITICAL or HIGH findings. This event then triggers a Step Functions state machine, which is ideal for orchestrating multi-step workflows like deleting image tags and sending SNS notifications. SNS is a robust service for sending notifications to various subscribers, including development teams. Incorrect options: Using SQS to trigger a Lambda function for scan results adds unnecessary complexity and latency compared to EventBridge's direct event-driven approach. Manually scheduling a Lambda function to run scans hourly misses newly pushed images until the next scheduled scan, failing the "automated process that scans newly pushed images" requirement. Periodic scanning also introduces a delay, as it doesn't scan immediately upon push. Using SQS with Step Functions for scan results is less direct than EventBridge for ECR scan events.