The organization uses AWS Organizations and must create automated daily incremental backups for any EBS volume tagged with Lifecycle: Production in a primary account. They also want to prevent users from deleting these production snapshots via EC2 permissions. Which solution meets both needs?

AWS Backup is the correct solution because it centrally manages backups across AWS services, including EBS, and supports tag-based selection for backup plans. This allows for automated daily incremental backups of EBS volumes tagged with Lifecycle: Production. Crucially, AWS Backup also creates immutable backups, meaning that even users with EC2 snapshot deletion permissions cannot delete these backups directly, fulfilling the requirement to prevent unauthorized deletion. Amazon Data Lifecycle Manager (DLM) can create daily snapshots based on tags, but it does not inherently prevent users with EC2 permissions from deleting those snapshots. An SCP denying snapshot deletion would be too broad and could interfere with legitimate operations. Creating AMIs (Amazon Machine Images) is for instance backup, not specifically EBS volume backup, and doesn't address the immutability requirement for snapshots.