Developers must tag all Amazon EBS volumes with a Backup_Frequency tag (values: none, daily, or weekly). Some volumes are sometimes left untagged. The company requires that all EBS volumes always have a Backup_Frequency tag and that the default is at least weekly when unspecified. Which solution enforces this requirement?

The correct answer leverages AWS Config to enforce the tagging policy. AWS Config managed rules can detect non-compliant resources, such as EBS volumes missing a specific tag. The tag-compliance managed rule, or a similar custom rule, can identify volumes without BackupFrequency. Integrating a remediation action with AWS Systems Manager Automation allows Config to automatically apply the BackupFrequency=weekly tag to non-compliant volumes, ensuring continuous compliance. Incorrect options: Creating a custom Config rule is possible but less efficient than using a managed rule for common compliance checks like tagging. CloudTrail tracks API calls but doesn't inherently enforce resource configurations or remediate non-compliance directly. While EventBridge can react to CloudTrail events, it would require complex logic to check for missing tags on existing volumes, not just newly created or modified ones. Config is designed for continuous compliance monitoring and remediation.