Developers use EC2 instances as remote workstations. The company wants to detect when users create or modify security group rules that allow unrestricted inbound access, remove those rules automatically, and notify the security team by email in near real time. A Lambda function exists that, given a security group ID, removes rules that allow unrestricted access and publishes notifications to an SNS topic. What step should the DevOps engineer take next to meet the requirements?

The correct solution leverages Amazon EventBridge to detect security group changes in near real time. An EventBridge rule on the default event bus can be configured with an event pattern to specifically match CreateSecurityGroup and AuthorizeSecurityGroupIngress API calls, which indicate security group creation or modification. This rule then directly invokes the existing Lambda function, which removes the offending rules and sends notifications. Incorrect options: Invoking the Lambda function via an SNS topic and CloudTrail subscription is overly complex and not the most direct way to trigger based on API calls. CloudTrail events can be directly consumed by EventBridge. An hourly scheduled rule would not meet the "near real-time" requirement. Creating a custom event bus is unnecessary here, as the default event bus already receives events from AWS services like EC2 and CloudTrail.