A security engineer must monitor Amazon Aurora MySQL DB instances and send email alerts when unknown users attempt to log in to the database endpoint. Which solution provides this capability with the least operational overhead?

The correct solution leverages Amazon GuardDuty's RDS Protection feature, which is specifically designed to detect suspicious login attempts, including those from unknown users, on Aurora MySQL DB instances. GuardDuty automatically integrates with RDS and generates findings, minimizing operational overhead. An EventBridge rule can then easily filter these findings and trigger an SNS topic to send email notifications, providing a fully managed, automated alerting mechanism. Incorrect options: Enabling serverauditlogging and using a Lambda function requires custom development and ongoing maintenance of the Lambda code to parse logs and identify unknown users, increasing operational overhead. Creating an RDS Custom AMI with a third-party agent introduces significant operational complexity, including managing the custom AMI, the agent, and migrating to RDS Custom, which is not designed for Aurora instances and has higher management overhead than standard Aurora. Writing a stored procedure and scheduling a recurring job within the database is not an ideal security practice as it places the detection logic within the database itself, potentially impacting performance and requiring database-level management for security monitoring. Aurora MySQL does not natively support sending email notifications directly through SNS from a stored procedure.