While an application rewrite is underway (12 months), the company needs an automated, low‑operational-effort way to find and rotate IAM access keys that are at least 30 days old, and then continue rotating keys every 30 days. Which solution provides the required automation with the least operational overhead?

The correct solution leverages AWS Config's iam-access-key-rotation managed rule to automatically detect non-compliant IAM access keys (older than 30 days). This rule can then trigger an AWS Systems Manager Automation runbook, such as AWS-RotateAccessKey, to perform the rotation. This approach is highly automated and requires minimal operational effort because AWS Config continuously monitors compliance and Systems Manager handles the key rotation process without manual intervention. Incorrect options: AWS Trusted Advisor identifies old keys but does not directly integrate with Systems Manager Automation for automatic rotation, requiring manual or custom integration. A custom script on an EC2 instance introduces operational overhead for managing the EC2 instance, the script, and its scheduling. An AWS Lambda function triggered by EventBridge on new key creation doesn't address the requirement of periodically rotating existing keys that are 30 days old. While a Lambda could be scheduled, the Config/Systems Manager solution is more purpose-built for this specific compliance and automation task.