A company uses a mobile app that stores sensitive data encrypted at rest with AWS KMS. The company must prevent accidental deletion of KMS keys and send an email via Amazon SNS to administrators when a user attempts to delete a KMS key. Which solution meets these requirements with the LEAST operational overhead?

The correct solution uses an Amazon EventBridge rule to detect the DeleteKey operation, which is a direct and efficient way to react to specific AWS API calls. This rule then triggers an AWS Systems Manager Automation runbook. Systems Manager Automation provides pre-built or custom runbooks to perform various AWS tasks, including stopping or reverting actions, making it suitable for canceling the KMS key deletion. Finally, the EventBridge rule can directly publish to an SNS topic to notify administrators, consolidating the notification mechanism. This approach minimizes operational overhead by leveraging managed services for event detection, automated remediation, and notification. The other options are less efficient: Option 1's AWS Config rule cannot directly cancel a KMS key deletion; Config rules are for evaluating compliance, not for real-time prevention of actions. Option 2 introduces a Lambda function for custom logic, which adds unnecessary complexity and operational overhead compared to a Systems Manager Automation runbook for a common task like preventing deletion. Option 4 only notifies administrators via