Automatically enforce required labels on all Compute Engine VMs at creation without changing the existing provisioning workflow; choose the most scalable corrective approach.

The correct answer is to trigger a Cloud Function from Cloud Audit Logs on VM creation. This approach is highly scalable and automated. Cloud Audit Logs capture VM creation events, which can then trigger a Cloud Function. The Function can inspect the new VM for required labels and, if missing, add them programmatically. This ensures immediate enforcement without altering existing provisioning workflows. Using Terraform with gcloud terraform vet only applies to resources provisioned through Terraform and doesn't address VMs created by other means. A scheduled script via Cloud Scheduler introduces a delay between VM creation and label enforcement, potentially leaving resources non-compliant for a period. Manually inspecting VMs is not scalable, error-prone, and defeats the purpose of automation.