A healthcare company wants to audit that a monitoring application runs only on EC2 Dedicated Hosts to control software licensing costs. The DevOps engineer must implement a workflow to detect noncompliant instances with minimal administrative overhead. Which approach meets this requirement with the least overhead?

The correct answer leverages AWS Config, a service designed for assessing, auditing, and evaluating the configurations of your AWS resources. By enabling recording for EC2 resources and creating a custom Config rule with a Lambda function, you can automatically detect instances not running on Dedicated Hosts. The evaluateCompliance() function within the Lambda will check the host placement and mark non-compliant instances. This approach offers minimal administrative overhead because AWS Config continuously monitors changes and evaluates compliance, providing built-in reporting. The other options involve significantly more administrative overhead. Using AWS Systems Manager Configuration Compliance with put-compliance-items requires manually building and maintaining compliance data. Writing custom Java code on EC2 with Auto Scaling, SQS, worker instances, and Lambda is a complex, custom solution with high development and maintenance costs. Analyzing CloudTrail logs with Lambda and storing data in RDS for MySQL also requires custom development for detection and reporting, increasing overhead compared to AWS Config's native capabilities.