Developers use Linux EC2 instances as bastion hosts with SSH access restricted by security group rules to specific IP addresses. The security team must be notified if those security group rules are changed to allow SSH from any IP address (0.0.0.0/0). What should the DevOps engineer implement to satisfy this requirement?

The correct answer is to create an AWS Config rule using the restricted-ssh managed rule. This rule specifically checks for security groups allowing unrestricted incoming SSH traffic (0.0.0.0/0). When this condition is met, AWS Config can automatically trigger an action, such as publishing a message to an Amazon SNS topic, thereby notifying the security team. The other options are less suitable: An Amazon EventBridge rule with AuthorizeSecurityGroupIngress would trigger for any change to security group ingress rules, not specifically for the 0.0.0.0/0 condition, leading to excessive notifications. Amazon GuardDuty focuses on threat detection and malicious activity, not on proactive compliance checks for security group configurations. While it might detect suspicious activity after a misconfiguration, it's not designed for continuous compliance monitoring of security group rules. Amazon Inspector is a vulnerability management service that scans EC2 instances and container images for software vulnerabilities and unintended network exposure, not for monitoring security group rule changes or specific ingress rules like 0.0.0.0/0.