To enforce tagging policy, an administrator needs any EC2 instance that lacks a department tag to be terminated almost immediately after creation. Which implementation will detect noncompliant instances and terminate them in near real time?

The correct option leverages AWS Config, which continuously monitors resource configurations for compliance. The required-tags managed rule specifically checks for the presence of specified tags. By enabling automatic remediation, AWS Config can automatically trigger a Systems Manager Automation document, such as AWS-TerminateEC2Instance, to terminate noncompliant instances almost immediately after detection. The other options are less suitable: An EventBridge rule forwarding to SNS would only notify of creation, not enforce tagging or terminate. It would require additional services (e.g., Lambda) to implement the termination logic, adding complexity and potential latency. Requiring ec2:CreateTags and ec2:DescribeTags permissions doesn't enforce the presence of a specific tag, nor does it automatically terminate instances lacking it. Setting shutdown behavior to terminate is for manual shutdown, not automated policy enforcement. AWS Systems Manager Compliance can report on compliance but doesn't automatically enforce tagging or terminate instances based on missing tags. Furthermore, AWS-StopEC2Instances would stop, not terminate, the instances, which doesn't meet the requirement.