Fabrikam Health already uses the AWS Config managed rule restricted-ssh to detect security groups allowing 0.0.0.0/0 on TCP/22. They want automatic remediation within one minute that removes the offending ingress as soon as the rule reports NON_COMPLIANT. What is the most suitable approach?

This is the most suitable approach because it provides immediate, automated remediation. An EventBridge rule triggered by Config Rules Compliance Change events for the restricted-ssh rule, specifically when complianceType is NONCOMPLIANT, ensures the remediation Lambda function is invoked precisely when needed. The Lambda function then directly calls RevokeSecurityGroupIngress to remove the problematic rule. The other options are less suitable: A custom Config rule that invokes a Lambda only when COMPLIANT would not remediate non-compliant resources. A scheduled EventBridge rule running hourly would not meet the "within one minute" requirement. AWS Firewall Manager is for central policy enforcement and would prevent such rules from being created, but it doesn't automatically remediate existing non-compliant rules in the specified timeframe without additional configuration for remediation.