The company imports SSL certificates from a third-party provider into AWS Certificate Manager (ACM) for use by public websites. The security team must receive a notification 90 days before any imported certificate expires. The company already has an Amazon SQS queue and an Amazon SNS topic with the security team's email subscribed. Which approach will deliver the required 90-day-before-expiration notification?

The correct approach uses Amazon EventBridge to directly capture the ACM Certificate Approaching Expiration event. This built-in event is specifically designed for certificate expiration notifications and can be configured to trigger 90 days before expiration. By setting the Amazon SNS topic as the target, the security team receives an email notification as required. Building an AWS Lambda function to scan for expiring certificates is less efficient and requires custom code for scheduling and certificate scanning, which is unnecessary given the native EventBridge event. AWS Step Functions workflows are overly complex for this simple notification requirement and would also necessitate custom logic. While AWS Config's acm-certificate-expiration-check rule can identify non-compliant certificates, it primarily focuses on compliance status rather than proactive, time-based expiration notifications directly, and requires an additional EventBridge rule to process compliance changes, adding complexity compared to the direct ACM event.