The security team relies on CloudTrail to detect critical security issues. The DevOps engineer needs to automatically remediate when CloudTrail logging is turned off, and wants the solution to minimize downtime for CloudTrail log delivery. Which approach provides the least delay?

The correct option directly addresses the StopLogging event, ensuring immediate remediation. CloudTrail emits StopLogging as an event to EventBridge, allowing for near real-time detection and response. A Lambda function can then be triggered to call StartLogging on the affected CloudTrail ARN, minimizing downtime for log delivery. The AWS Config rule option introduces a delay of up to one hour due to its periodic check, which is not ideal for minimizing downtime. A scheduled EventBridge rule every 5 minutes also introduces a delay and is less efficient than event-driven detection. Running a script on an EC2 instance every 5 minutes is less serverless, less efficient, and also introduces a delay, making it a less optimal solution compared to an event-driven approach.