An application running on EC2 writes custom DECRYP_ERROR messages into CloudWatch Logs. The development team must be alerted in real time when these errors appear in production with minimal operational effort. What is the best solution?

The correct solution leverages CloudWatch Logs metric filters, which are designed for this exact use case. A metric filter extracts numerical values from log events, allowing you to create a custom metric. Setting an alarm on this metric with a threshold of 1 or more ensures real-time notification via SNS whenever a DECRYPERROR log entry appears. This is a fully managed, serverless approach requiring minimal operational effort. Modifying the application to push custom metrics is unnecessary and adds complexity. A Lambda function polling logs every 5 minutes introduces latency and is less efficient than real-time metric filtering. The CloudWatch unified agent is for collecting logs and metrics, but the application generating a metric for DECRYPERROR and the agent sending SNS notifications directly is not how it's typically used for log-based alerts; the metric filter and alarm approach is standard.