A team needs to automatically quarantine an EC2 instance when GuardDuty detects a cryptocurrency mining finding. Which architecture achieves this with the least custom code?
-
A
EventBridge rule matching the GuardDuty finding type triggers an SSM Automation runbook that isolates the instance
-
B
A Lambda function polling the GuardDuty API every minute to check for findings
-
C
CloudTrail alarm in CloudWatch that triggers an SNS topic to notify the security team
-
D
AWS Config rule that detects the instance and sends a remediation notification