Your organization runs a sensitive workload in an AWS account and uses ServiceNow for incident management. Security groups are already configured. The requirement is to automatically open a ServiceNow incident whenever any security group rule is modified. Which approach accomplishes this with the least operational overhead?

The correct answer leverages EventBridge to react to specific API calls captured by CloudTrail, which is the most direct and efficient way to detect security group modifications. The AWS-CreateServiceNowIncident Systems Manager Automation runbook is a pre-built solution for integrating with ServiceNow, minimizing custom development. The CloudWatch alarm option is less suitable because CloudWatch alarms are primarily for metrics, not directly for API call events. While you could create a custom metric from CloudTrail logs, it adds unnecessary complexity. Security Hub is for security posture management and findings, not for directly triggering on every API call modification. The EC2 instance with a cron script is a manual, polling-based approach that introduces significant operational overhead, latency, and a single point of failure compared to event-driven solutions.