A policy requires disabling access keys and passwords for any IAM user who hasn’t been active for 90 days or more. You must implement an automated, operationally efficient solution to disable unused credentials. Which design meets this requirement?

The correct answer leverages AWS Config and Systems Manager Automation for an efficient, automated solution. An AWS Config managed rule can continuously evaluate compliance for IAM user activity, identifying those inactive for 90 days. When a non-compliant resource is detected, AWS Config can trigger an AWS Systems Manager Automation runbook. This runbook can then execute the necessary actions to disable the identified IAM users' access keys and passwords, meeting the policy requirement automatically and operationally efficiently. Incorrect options: Building a Step Functions workflow with a Lambda triggered by EventBridge is possible but more complex than using existing AWS Config and Systems Manager capabilities for this specific use case. Running a weekly batch job on an EC2 instance introduces operational overhead for managing the EC2 instance and the batch job itself, which is less operationally efficient than serverless automation. Running a Python script on an EC2 instance to delete IAM user accounts is too aggressive; the requirement is to disable access keys and passwords, not delete the entire account. This also has the same operational overhead as the previous incorrect option.