The company enforces a rule that no security group should allow SSH from 0.0.0.0/0. A SysOps administrator must implement a solution that alerts the operations team when a security group breaks this rule and must automatically remediate the offending rule. Which design satisfies both requirements?

The correct answer leverages AWS Config, which is designed for continuous monitoring and automatic remediation of resource configurations. The restricted-ssh managed rule specifically checks for security groups allowing SSH from 0.0.0.0/0. Attaching the AWS-DisablePublicAccessForSecurityGroup Systems Manager Automation runbook provides the automatic remediation. An EventBridge rule can then easily trigger notifications based on Config rule compliance changes. Option 1 is incorrect because removing all inbound rules is overly aggressive and could disrupt legitimate services. Option 2 is less efficient than Config for this specific use case. While it could detect changes, Config provides a more direct and integrated solution for compliance checks and remediation. Option 4 is also less efficient. While CloudTrail and CloudWatch can detect changes, Config's built-in compliance checks and remediation actions are purpose-built for this scenario, offering a more streamlined and robust solution.