A security audit found several unencrypted Amazon EBS volumes attached to thousands of EC2 instances in a company account. Company policy mandates EBS volume encryption. The company needs an automated remediation to encrypt existing unencrypted volumes and to prevent development teams from creating unencrypted volumes. Which solution meets these requirements?

The correct solution addresses both existing unencrypted volumes and prevents future unencrypted volumes. AWS Config with a managed rule can detect unencrypted EBS volumes. An automatic remediation action linked to an AWS Systems Manager Automation runbook can then create new encrypted volumes from snapshots of the unencrypted ones, replacing the originals. Modifying the AWS account setting for EBS encryption ensures all newly created EBS volumes are encrypted by default, preventing development teams from creating unencrypted volumes. Incorrect options: Using a KMS key policy to deny unencrypted EBS volume creation is not the standard or most effective way to enforce EBS encryption at the account level. AWS Systems Manager Fleet Manager is for managing instances, not primarily for listing unencrypted EBS volumes for remediation. SCPs are for organizational-level control, not account-level settings for EBS encryption. While Fleet Manager is incorrect, the third option also misses the automated remediation for existing volumes, only focusing on preventing new ones.