A security engineer needs to receive email notifications whenever Amazon GuardDuty, AWS Identity and Access Management (IAM) Access Analyzer, or Amazon Macie generate a high-severity finding. The company uses AWS Control Tower for governance and has AWS Security Hub enabled with all service integrations. Which solution provides the required alerts with the least operational overhead?

The correct solution leverages AWS Security Hub's aggregation capabilities. Since Security Hub is already enabled with all service integrations, it consolidates findings from GuardDuty, IAM Access Analyzer, and Macie. An Amazon EventBridge rule can then filter these consolidated findings for high severity and publish them to an Amazon SNS topic, which sends email notifications. This approach minimizes operational overhead by using existing integrations and managed services. Incorrect options: Creating separate Lambda functions for each service introduces significant operational overhead for development, deployment, and maintenance of multiple functions and schedules. AWS Control Tower events primarily relate to governance and account provisioning, not individual security findings from GuardDuty, IAM Access Analyzer, or Macie. This would not capture the required alerts. Hosting an application on Amazon EC2 adds substantial operational overhead for server management, patching, and scaling, which is unnecessary given the availability of managed services.