The SecOps team must receive an SNS email notification if any member account in the organization disables S3 Block Public Access at the bucket level. The solution must not rely on changes in member accounts and must prevent member accounts from disabling the notification. Which solution meets these requirements?

The correct solution leverages AWS Config organization-wide, which allows central management and monitoring of resource compliance across all member accounts without requiring changes within those accounts. The s3-bucket-level-public-access-prohibited managed rule directly addresses the requirement to detect disabled S3 Block Public Access. A conformance pack ensures consistent deployment of this rule. An SSM document can then be used to publish violations to a centralized SNS topic in the delegated administrator account, ensuring SecOps receives notifications and preventing member accounts from disabling this critical monitoring. Incorrect options: GuardDuty focuses on threat detection, not configuration compliance for S3 Block Public Access. Deploying a CloudFormation StackSet directly into member accounts for notifications could be circumvented by those accounts, violating the "prevent member accounts from disabling the notification" requirement. Amazon Inspector focuses on vulnerability management and security findings, not specifically S3 Block Public Access configuration compliance.