A production image contains an OS package with a newly published vulnerability. The team needs continuous supported vulnerability assessment of ECR images and EC2 instances. Which service fits?

1. Amazon Macie sensitive-data discovery.
2. Route 53 Resolver query logs only.
3. AWS Config required-tags rules only.
4. Amazon Inspector with the applicable scanning coverage enabled.