Production account policy requires any EC2 instance that has been accessed interactively to be terminated within 24 hours. All production apps run in Auto Scaling groups and send logs using the CloudWatch Logs agent. How can you automate detecting a manual login and ensuring such instances are terminated within 24 hours?

The correct option leverages CloudWatch Logs to detect the interactive login, as all instances send logs there. A CloudWatch Logs subscription filter can trigger a Lambda function when a login event (e.g., SSH or RDP success) is found. This Lambda function then identifies the EC2 instance and adds a tag to it, marking it for termination. An EventBridge rule scheduled to run daily will invoke another Lambda function. This second Lambda function scans for all instances with the specific tag and terminates them, ensuring the 24-hour policy is met. The incorrect options are less efficient or don't fully automate the process. The Step Functions option adds unnecessary complexity. The SNS option relies on manual intervention, which doesn't meet the "automate" requirement. The SQS option introduces worker instances and an EventBridge rule, which is more complex than a direct Lambda-to-EventBridge solution for this specific task.