A security audit found security groups allowing SSH from 0.0.0.0/0. The security team must detect and remediate this as soon as possible across all accounts in a single AWS Organizations organization. Which approach accomplishes detection and automated remediation?

The correct option uses AWS Config, a service designed for continuous monitoring and auditing of AWS resource configurations. By enabling AWS Config in every account and creating a custom rule, you can specifically target security groups allowing SSH from 0.0.0.0/0. The restricted-ssh configuration change trigger ensures the rule evaluates security groups when they are created or modified, providing near real-time detection. Invoking a Lambda function for non-compliant resources allows for automated remediation, fulfilling both detection and remediation requirements across the organization. The first incorrect option uses a managed rule that might not be specific enough or allow for custom remediation logic. The second incorrect option is overly aggressive, deleting all security group rules, which would cause significant service disruption. The fourth incorrect option relies on a scheduled Systems Manager Automation, which provides periodic checks rather than real-time detection on configuration changes, and requires deployment in each account, which is less centralized than an AWS Config rule deployed via Organizations.