A company uses AWS Network Firewall to protect outbound traffic for many VPCs in one account. EC2 instances host applications and are tagged with their application name; instances run in Auto Scaling groups. A Network Firewall stateful rule group must stay current as instances scale up and down. Which approach requires the least implementation and administrative effort?

The correct answer is to create a resource group for each application name and reference the resource group's ARN in the stateful rule group. AWS Network Firewall stateful rule groups can directly reference resource groups. Resource groups dynamically update their membership based on tags, ensuring the firewall rules automatically reflect changes as EC2 instances scale up or down without manual intervention or custom code. Creating a network ACL for each application is incorrect because network ACLs are stateless and operate at the subnet level, not directly integrated with Network Firewall stateful rules in this dynamic way. Creating a prefix list for each application is incorrect because prefix lists are static or require manual updates or a separate automation to keep them current with dynamic EC2 IP addresses. Creating a Lambda function to query EC2 tags and update the rule group is incorrect because while feasible, it introduces custom code complexity and administrative overhead, which the resource group integration avoids.