A company uses a transit gateway to connect many VPCs. Changes to security groups, network ACLs, or route tables in a VPC have in the past caused loss of connectivity. When such changes occur, the company wants an automatic verification that connectivity between resources within a single VPC still works. Which solution accomplishes this?

The correct solution uses VPC Reachability Analyzer to define and test connectivity paths within a VPC. CloudTrail logs API calls for configuration changes (e.g., security groups, NACLs, route tables), making it the appropriate service for EventBridge to monitor. When CloudTrail logs a relevant change, EventBridge triggers a Lambda function. This Lambda function then invokes Reachability Analyzer to re-evaluate the defined paths, automatically verifying connectivity. The incorrect options are: Using CloudWatch logs for configuration changes is less precise than CloudTrail, which specifically logs API calls. Transit Gateway Network Manager Route Analyzer is designed for analyzing routes through a Transit Gateway, not for verifying connectivity within a single VPC. The question specifically asks about connectivity between resources within a single VPC.