A security team ran a pilot with 100 cameras that uploaded images to object storage and used an image recognition service to tag images and store results in a search index. They now want to scale to thousands of cameras globally to detect suspicious activities by non-employees in near real time. Which architecture should they consider?

The correct option leverages existing camera infrastructure (RTSP feeds) and scales efficiently. A local proxy aggregates feeds, reducing individual camera connections to the cloud. Managed video streams (like Kinesis Video Streams) handle ingestion at scale. A managed video analysis service with a stream processor (like Rekognition Video) is ideal for real-time, continuous analysis of video streams, including face detection and comparison against known employees. This approach directly addresses the "near real-time" and "thousands of cameras globally" requirements. The second option is less efficient because processing individual frames from a video stream for face detection is computationally more intensive and less optimized for continuous video analysis than a dedicated video analysis service. The third and fourth options involve replacing cameras with edge devices, which is a significant and unnecessary capital expenditure for a pilot that already established camera functionality. The fourth option also uses a serverless function to extract frames, which adds latency and complexity compared to a managed video analysis service.