The company wants to detect when the Amazon EC2 CreateImage API operation is called in its account and send an alert. The company currently copies AMIs only within the Region where they were created. Which solution meets this requirement with the LEAST operational overhead?

The most efficient solution is to use Amazon EventBridge (formerly CloudWatch Events). EventBridge can directly monitor AWS API calls captured by CloudTrail. By creating a rule that specifically filters for the CreateImage API call event, EventBridge can then trigger an Amazon SNS topic as a target. This SNS topic can send alerts via email, SMS, or other supported endpoints. This approach is serverless and event-driven, requiring minimal configuration and no ongoing management of compute resources, thus offering the least operational overhead. Other options involve more complex architectures: Querying CloudTrail logs with Lambda or Athena introduces polling or batch processing, which is less real-time and adds operational complexity. Using SQS FIFO queue as a target for CloudTrail logs and then a Lambda function adds unnecessary layers and complexity for a simple API call detection.