A Lambda function starts a CloudFormation drift detection on a stack then exits. An EventBridge scheduled rule runs this Lambda hourly. An SNS topic exists and the engineer is subscribed to it. The engineer wants to be notified as soon as possible when drift is detected for that stack. Which solution satisfies this requirement?

The most efficient solution is to enable AWS Config with the cloudformation-stack-drift-detection-check managed rule. This rule automatically monitors CloudFormation stacks for drift. When drift is detected, AWS Config generates a compliance change event. An EventBridge rule can then be configured to capture this specific event for the stack and publish a notification to the SNS topic, ensuring immediate alerts. The other options are less suitable: Having the existing EventBridge rule target SNS with a filter policy won't work because the initial Lambda only starts drift detection, it doesn't report the result. A second Lambda querying CloudFormation for results introduces unnecessary complexity and polling logic. GuardDuty is a threat detection service, not for CloudFormation drift detection.