Employees have limited AWS permissions, but DevOps engineers can assume an administrator role. The security team needs near-real-time notifications whenever the administrator role is assumed. What should be implemented?

The correct solution uses an Amazon EventBridge rule to directly detect the AssumeRole API call, which CloudTrail logs. This provides near-real-time detection. The EventBridge rule can then invoke an AWS Lambda function to process the event and publish a customized message to an Amazon SNS topic, ensuring the security team receives immediate and relevant notifications. Incorrect options: AWS Config and Amazon Athena are suitable for auditing and historical analysis, not near-real-time notifications. Amazon GuardDuty focuses on detecting threats and anomalous behavior, not specifically on notifying about every AssumeRole event for a known administrator role. Matching "AWS Management Console sign-in events" in EventBridge would miss programmatic AssumeRole calls and might not specifically filter for the administrator role assumption itself, leading to incomplete or inaccurate notifications.