Developers are prohibited from launching VPC network infrastructure. Whenever a NAT gateway is created, the network security team must immediately be alerted to terminate it. The solution should be easy to deploy across multiple AWS accounts, have minimal admin overhead, and provide an accessible compliance history. Which solution satisfies these requirements?

The correct answer leverages AWS Config, Systems Manager Automation, and CloudFormation StackSets for a robust, scalable, and compliant solution. AWS Config provides continuous monitoring and compliance history, automatically triggering a Systems Manager Automation runbook to terminate the NAT Gateway and send alerts. CloudFormation StackSets enable easy, consistent deployment across multiple accounts with minimal administrative overhead. The other options are less suitable: Developing a script on EC2 instances in each account is high overhead, lacks centralized compliance history, and is not easily scalable. A Lambda function deployed with SAM is better, but storing results in OpenSearch Service in each account adds complexity and cost compared to Config's built-in history. GuardDuty is for threat detection, not for enforcing resource provisioning policies. While it can detect NAT gateway creation, it's not the primary service for this type of compliance enforcement, and Step Functions adds unnecessary complexity for this specific task.