Developers must only launch EC2 instances from an approved set of AMIs, but some are still starting instances from unapproved images. The operations team needs an automated way to detect and terminate any EC2 instance launched from an AMI that is not on the approved list. Which approach satisfies this requirement?

The correct answer leverages AWS Config to continuously monitor EC2 instances for compliance. An AWS Config managed rule can be configured to check if an instance's AMI is on an approved list. If an instance is found non-compliant, Config's automatic remediation feature can trigger an AWS Systems Manager Automation runbook to terminate that instance, providing an automated and efficient solution. Storing approved AMI IDs in DynamoDB and using EC2 launch templates is not a detection and termination mechanism for already launched unapproved instances. CloudWatch metrics and alarms are not designed to directly inspect AMI IDs for compliance in this manner. While Amazon Inspector can identify security vulnerabilities, it's not the primary service for enforcing AMI compliance and automatically terminating instances based on custom AMI lists.