Multiple development teams share a single AWS account. All EC2 resources must be tagged within one hour of creation with the creator's user ID and a cost center ID. CloudTrail logs are delivered to an S3 bucket. The engineer wrote a Lambda to apply cost-center tags. Which solution ensures resources are tagged promptly and reliably?

The correct solution is to create an EventBridge rule with Amazon EC2 as the event source that matches CloudTrail EC2 events and targets the Lambda function. This approach provides near real-time detection of EC2 instance creation events, allowing the Lambda function to be invoked promptly to apply the required tags. EventBridge can filter specific CloudTrail events, ensuring the Lambda is only triggered when relevant EC2 actions occur. Incorrect options: S3 event notifications on the CloudTrail bucket for s3:ObjectTagging:Put events are irrelevant because CloudTrail logs are objects in S3, and you're interested in the content of the logs (EC2 events), not S3 object tagging events. Enabling server access logging on the S3 bucket and creating S3 event notifications for s3:ObjectTagging: events is also incorrect for the same reason; it focuses on S3 object operations, not the EC2 events recorded within the CloudTrail logs. An hourly scheduled EventBridge rule would introduce a significant delay, failing to meet the "within one hour" requirement reliably, as resources could be created just after a scan and remain untagged for almost an hour.