A company is launching a new web application on Amazon EC2 instances. Development and production workloads exist in separate AWS accounts. According to the company's security requirements, only automa

Turning on CloudTrail logs only in the primary region would miss API calls or actions performed in other regions or by global services, failing to provide comprehensive monitoring for all manual access attempts.

Amazon Simple Email Service (SES) is an email sending service, not a monitoring or alerting service capable of detecting events and triggering notifications itself. While it could be a target for notifications, it cannot initiate alerts based on CloudTrail events.

Configuring EC2 launch templates to deploy instances without SSH key pairs helps prevent direct manual SSH access, aligning with the security requirement for only automated configuration tools to interact with production EC2 instances. Legitimate, auditable access for automation can then be managed through services like AWS Systems Manager Session Manager.

An Amazon Simple Notification Service (SNS) topic is essential for immediate, fan-out notifications, allowing CloudWatch Alarms to send real-time alerts to the security team via email or other subscribed endpoints when manual access events are detected.

Enabling AWS CloudTrail logs for all AWS Regions provides a comprehensive audit trail of all API calls and console actions, which is crucial for detecting any manual access attempts across the entire AWS environment. Amazon CloudWatch alarms can then be configured to process these logs in real-time to identify and alert on specific manual access events.

Configuring a launch template to 'delete the key' is not a standard or meaningful configuration; instances are launched either with or without a specified key pair. This option is technically incorrect and doesn't align with best practices for secure EC2 access.