To meet new compliance requirements, a company must ensure that all Amazon RDS DB instances and DB clusters use encrypted storage. The company needs an automated solution that emails an alert whenever an unencrypted DB instance or cluster is created and also deletes the unencrypted resource. Which option is the most operationally efficient?

The correct option leverages AWS Config's ability to continuously monitor resource compliance and automatically remediate non-compliant resources. The rds-storage-encrypted managed rule directly detects unencrypted RDS instances and clusters. Automatic remediation allows Config to trigger an SNS topic, which then invokes a Lambda function to delete the non-compliant resource and send an email notification. This is operationally efficient because it automates both detection and remediation. The second option is incorrect because it specifies manual remediation, which does not meet the requirement for an automated solution. The third and fourth options are incorrect because while EventBridge can detect creation events, it cannot directly assess the encryption status of the storage at the time of creation or modification in the same way Config can continuously evaluate existing resources against compliance rules. EventBridge would require more complex logic within the Lambda function to check encryption status, making Config a more direct and efficient solution for compliance.