The company runs tests in a single AWS account on Amazon EC2 instances. AWS Config is enabled with the restricted-ssh managed rule. The team needs an automated, real-time notification that is customized and includes the noncompliant security group's name and ID whenever any security group violates the restricted-ssh rule. An SNS topic already exists with the appropriate subscribers. What should the DevOps engineer do next to meet this requirement?

The correct solution leverages Amazon EventBridge to react to AWS Config rule evaluations. When the restricted-ssh rule reports a NONCOMPLIANT status, EventBridge triggers. An input transformer is crucial here, as it allows for custom extraction of specific details like the security group's name and ID from the Config event, formatting them into a tailored message. This transformed message is then published to the existing SNS topic, fulfilling the requirement for real-time, customized notifications. Incorrect options: Directly forwarding AWS Config evaluations to SNS with a filter policy would send the entire, untransformed event, not a customized message with specific details. Using AWS Systems Manager Run Command for custom notification is overly complex and unnecessary; EventBridge's input transformer handles this efficiently. An EventBridge rule matching any NONCOMPLIANT evaluation without specifying the restricted-ssh rule would trigger for all non-compliant resources, not just those violating the SSH restriction, and would still lack the specific input transformer for the required details.