A DevOps engineer must implement a solution that immediately terminates Amazon EC2 instances in Auto Scaling groups when cryptocurrency mining activity is detected. Which solution will meet these…

Configuring Amazon Route 53 to send query logs to Amazon CloudWatch Logs allows for the detection of specific DNS queries associated with cryptocurrency mining pools. By creating CloudWatch Logs metric filters and alarms based on these patterns, an Amazon EventBridge rule can trigger an AWS Lambda function to immediately terminate non-compliant Amazon EC2 instances, minimizing custom code for detection beyond simple log pattern matching and configuration.

Analyzing raw VPC Flow Logs in an Amazon S3 bucket for cryptocurrency mining patterns would require significant development effort to parse, process, and apply complex detection logic using custom AWS Lambda functions or other analytics services.

While Amazon GuardDuty is highly effective for detecting cryptocurrency mining activity, the question emphasizes 'least development effort.' If the detection relies on a specific, known DNS pattern, configuring CloudWatch metric filters for Route 53 logs might be considered less 'development' than enabling a broader, continuous threat detection service like GuardDuty.

AWS Security Hub aggregates security findings but does not perform the direct detection of cryptocurrency mining activity. Using it would add an unnecessary layer of integration when direct detection and response can be configured with specialized logging and monitoring services.