A security team requires continuous detection of instances whose security groups expose administrative ports to the internet. Which service is best suited to evaluate that configuration rule?

1. AWS Config with the appropriate managed or custom rule and remediation workflow.
2. CloudTrail alone as automatic enforcement of every security group standard.
3. Macie as a security group packet filter.
4. S3 Inventory for all EC2 network permissions.