Exam AWS Certified DevOps Engineer - Professional DOP-C02 topic 1 question 153 discussion

B is correct: < Attach an IAM policy to the developers' IAM group to deny associate-address permissions>: means we can deny all address-assosiate attempts A: AWS CloudTrail logs is used for monitoring users' actions. Though it would reveal associate-address attempts, it would not trigger AWS lambda to disassosiate the IPs C: <Ensure that all IAM groups associated with developers do not have associate-address permissions>: This is unnecessary and can be done more easily with option B. D: <check that all production instances have EC2 IAM roles>: We dont need to check the role of the EC2, we need to handle the role of developers. Summary: D is irrelevant while A and C, though can achive the requirements, consume more efforts and resources.

AWS Config provides the eip-attached managed rule to evaluate whether all allocated Elastic IPs are associated with a resource.

For what it's worth: { "Statement": [ { "Action": [ "ec2:AssociateAddress", "ec2:DisassociateAddress" ], "Effect": "Deny", "Resource": "*" } ] }

answer B

so easy, almost copy/paste from the two requirements listed inside the question

It's B, the only who meets the question criteria.

B is correct