An organization uses AWS Organizations to manage multiple accounts. Security policy requires marking any unencrypted Amazon EBS volumes as noncompliant. A DevOps engineer must deploy an automated, always-present compliance check. Which approach accomplishes this?

The correct approach is to create an AWS Config organizational rule. AWS Config organizational rules allow you to deploy and manage compliance rules across all accounts in your AWS Organization from a central management account, ensuring an "always-present" check. The ebs-encrypted-volumes managed rule specifically checks for unencrypted EBS volumes. Applying an SCP to prevent stopping or deleting AWS Config ensures the compliance checks remain active and cannot be tampered with by individual account users, fulfilling the "always-present" requirement. Incorrect options: AWS Inspector is for vulnerability management, not continuous compliance checks for resource configurations like EBS encryption. CloudFormation templates for Inspector rules wouldn't achieve the desired compliance check. An SCP can prevent the launch of unencrypted volumes but won't identify existing unencrypted volumes, nor will it mark them as noncompliant. It's a preventative measure, not a compliance auditor for existing resources. Deploying an IAM role and using a Lambda function in a pipeline is a custom solution that requires significant development and maintenance. While possible, it's less efficient and robust than using a native AWS Config organizational rule for this specific use case.