An organization wants a centralized, automated method across all accounts in AWS Organizations to detect security groups that permit inbound traffic from 0.0.0.0/0 and to automatically remediate violations by replacing that wide-open source with the company's approved intranet CIDR. What actions should a SysOps administrator implement to achieve this?

AWS Config is designed for continuous monitoring and automatic remediation of resource configurations across multiple accounts in AWS Organizations. A custom Config rule can be deployed to detect security groups with inbound rules from 0.0.0.0/0. Config's remediation actions can then be configured to automatically modify these rules, replacing 0.0.0.0/0 with the specified intranet CIDR block, ensuring compliance. An IAM policy denying creation of security groups with 0.0.0.0/0 would prevent new insecure groups but wouldn't remediate existing ones and is not a centralized, automated remediation solution. A Lambda function could scan and remediate, but AWS Config provides a more integrated and managed service for this specific use case, including multi-account deployment. An SCP can block creation but cannot perform automatic remediation of existing resources or modify rules.