CloudTrail is enabled in an AWS account, and the requirement is to automatically re-enable CloudTrail immediately if it gets turned off — without writing custom code. Which approach meets this requirement?

The correct approach is to use an AWS Config rule with a managed remediation action. AWS Config can continuously monitor your AWS resource configurations for compliance. The cloudtrail-enabled managed rule can detect if CloudTrail is disabled. By attaching the AWS-ConfigureCloudTrailLogging managed remediation action, AWS Config can automatically re-enable CloudTrail when it detects non-compliance, without requiring custom code. Adding the account to AWS Organizations and enabling CloudTrail from the management account ensures CloudTrail is on, but doesn't automatically re-enable it if an individual account user turns it off. Creating an AWS Config rule to invoke a Lambda function would work but involves writing custom code, which the question explicitly seeks to avoid. An EventBridge scheduled rule running an SSM Automation document could also re-enable CloudTrail, but it's not immediate and still requires custom setup beyond a simple managed remediation.