A recent CloudFormation stack update failed and a DevOps engineer found that some stack resources were manually modified. The engineer needs to detect manual modifications to CloudFormation-managed resources and alert the DevOps lead with minimal operational effort. What solution meets this need?

The correct solution leverages the CLOUDFORMATIONSTACKDRIFTDETECTIONCHECK AWS Config managed rule, which specifically identifies manual modifications (drift) in CloudFormation-managed resources. When this rule detects drift, it marks the resource as NONCOMPLIANT. An Amazon EventBridge rule can then be configured to trigger on this NONCOMPLIANT status and publish a message to an Amazon SNS topic, which in turn notifies the DevOps lead via email. This approach is efficient and requires minimal operational effort as it uses existing AWS managed services. The second option is incorrect because creating a custom AWS Config rule and a Lambda function for email notification adds unnecessary complexity and operational overhead compared to using the managed rule and SNS. The third option is incorrect because triggering on COMPLIANT status would not alert for drift; alerts are needed when resources are NONCOMPLIANT. The fourth option is incorrect because while it detects NONCOMPLIANT status, using a Lambda function for email is less efficient than directly using SNS with an email subscription.