A DevOps team supports an application running on many EC2 instances in an Auto Scaling group, deployed via CloudFormation. One instance recently returned errors for a large share of requests while remaining healthy to EC2 and ELB health checks. Application logs are collected in CloudWatch using embedded metric format. The team needs an alert if any single EC2 instance accounts for more than half of all errors, with minimal operational overhead. Which combination of steps achieves this? (Choose two.)

The problem requires identifying a single instance causing more than half of all errors. CloudWatch Contributor Insights is designed for this exact purpose: it analyzes log data to find top contributors (e.g., instance IDs, IP addresses) to specific events (e.g., errors). Creating a CloudWatch Contributor Insights rule that groups application logs by instance ID and error occurrences (e.g., "Error" in logs) directly identifies which instances are contributing most to errors. Once the Contributor Insights rule is in place, a CloudWatch alarm can use the INSIGHTRULEMETRIC function to monitor the output of this rule. This function allows the alarm to detect if any single contributor (instance ID) exceeds a defined threshold (more than 50% of errors), triggering a notification via an SNS topic. This combination provides a low-overhead solution tailored to the problem. Incorrect options: Resource Groups and Application Insights are for broader application monitoring, not specifically for identifying top contributors to a metric from logs. A simple metric filter counts errors but doesn't attribute them to specific instances or compare an instance's errors to the total. A Lambda function for each error is high overhead and complex to implement for this specific comparison.