You operate hundreds of EC2 instances in a single region within one AWS account. New instances are launched and terminated hourly; some existing instances have been running more than a week. Company policy mandates that every running EC2 instance must have an instance profile attached. There is a default instance profile that must be attached to any instance missing a profile. Which approach enforces this requirement?

The correct answer is to enable AWS Config with the ec2-instance-profile-attached managed rule and configure automatic remediation using an AWS Systems Manager Automation runbook. AWS Config continuously monitors resource compliance against defined rules. The ec2-instance-profile-attached rule specifically checks if EC2 instances have an instance profile. When non-compliant instances are detected (i.e., missing a profile), automatic remediation can trigger an SSM Automation runbook to attach the default instance profile, ensuring ongoing compliance for both new and existing instances. The other options are less effective: Matching RunInstances API calls with EventBridge only addresses newly launched instances, not existing ones that might lose their profile or instances started from a stopped state. Matching StartInstances API calls with EventBridge also only addresses instances transitioning from a stopped state, not instances launched initially or those running for a long time that might become non-compliant. The iam-role-managed-policy-check AWS Config rule checks for managed policies attached to IAM roles, not for instance profiles attached to EC2 instances, making it irrelevant to this requirement.