A company uses AWS Certificate Manager (ACM) for public TLS certificates. A SysOps admin needs to send an email alert when any certificate has fewer than 14 days until expiration. Which solution provides that notification with the least operational effort?

The correct solution leverages EventBridge's native integration with ACM to monitor certificate expiration. EventBridge can directly evaluate the DaysToExpiry metric published by ACM and trigger an SNS topic when the value falls below 14 days. This is the most operationally efficient method as it requires no custom code or manual metric creation. Creating a custom CloudWatch metric for certificate expiration (first incorrect option) is unnecessary because ACM already publishes the DaysToExpiry metric. Manually monitoring a CloudWatch dashboard and running CLI commands (third incorrect option) is not automated and requires significant operational effort. Configuring an SMS identity (fourth incorrect option) is incorrect; while EventBridge can trigger SNS, SMS is a separate service for text messages, and the question asks for email alerts.