Omnix Health wants automatic containment when GuardDuty raises EC2 compromise findings, while preserving remote forensic access. The SOC requires that affected instances be quarantined to block all external traffic except Systems Manager, and that EBS snapshots be created for evidence. Which solution best meets the requirement?

This solution directly addresses all requirements. An EventBridge rule triggered by GuardDuty EC2 compromise findings initiates a Lambda function. This function replaces the instance's security groups with a quarantine security group, which is configured to block all external traffic while specifically allowing Systems Manager (SSM) access via VPC endpoints. This preserves remote forensic access as required. The Lambda function then creates EBS snapshots for evidence and notifies the SOC via SNS. The other options are incorrect because: CloudWatch alarms on CPU spikes are not related to GuardDuty findings and would not provide targeted containment for EC2 compromises. Removing the instance profile on RunInstances is a preventative measure for new instances, not a containment action for an already compromised running instance. GuardDuty does not have a built-in quarantine action that automatically isolates instances and snapshots volumes; custom automation is required.