A photo-sharing app stores images in S3. A third-party auditor manually inspects images and records results 1–24 hours after upload to a DynamoDB table keyed by the S3 object key. The third party exposes the audit results via a REST API. You need an automated process to tag each S3 object with its audit result, implemented in the most operationally efficient way. Which approach should you take?

This solution is the most operationally efficient because Step Functions excels at orchestrating complex workflows with built-in wait states, eliminating the need for custom retry logic or managing message visibility timeouts. The s3:ObjectCreated event reliably triggers the process. The Wait state ensures the audit results are available before attempting to retrieve them, and a subsequent Lambda performs the tagging. The SQS solution is less efficient due to the complexity of managing visibility timeouts for up to 24 hours and potential message duplication or loss if not handled carefully. Periodically scanning S3 is inefficient as it requires iterating through all objects, and calling the third-party API for each untagged object can be costly and slow. An EC2 instance is less operationally efficient than serverless options, requiring patching, maintenance, and scaling considerations.