The correct answer is: Create an Amazon EventBridge (formerly CloudWatch Events) rule that filters for the CreateImage API call. Configure an Amazon SNS topic as the target to send notifications.

Amazon EventBridge (formerly CloudWatch Events) can directly capture AWS API calls logged by CloudTrail in near real time. You can create a rule that matches the CreateImage API action and immediately trigger an alert through Amazon SNS when the event occurs. This solution is serverless, scalable, and requires minimal maintenance.

Why the other options are incorrect:

Using a Lambda function to poll CloudTrail logs increases operational overhead and introduces delays. You must manage invocation frequency and permissions, and polling is less efficient than event-driven detection.

Configuring CloudTrail with SNS on S3 delivery, then using Athena queries introduces unnecessary complexity and latency. You must wait for CloudTrail to deliver logs, then schedule Athena queries or trigger them indirectlythis is not real-time and adds more moving parts.

Sending CloudTrail logs to an SQS FIFO queue and using Lambda to parse events is more complex than necessary for this use case. This approach increases cost, complexity, and the number of components to monitor.

Why this question matters: This question tests your knowledge of event-driven monitoring using EventBridge and CloudTrail integration, which is a best practice for real-time security and operations monitoring in AWS.

Tip: When monitoring for specific API actions, EventBridge + CloudTrail + SNS is often the most efficient and scalable solution with the least operational burden.

Full AWS Practitioner Certification Question