A Security Engineer has been asked to create an automated process to disable IAM user access keys that are more than three months old. Which of the following options should the Security Engineer use?
A.
In the AWS Console, choose the IAM service and select ג€Usersג€. Review the ג€Access Key Ageג€ column.
B.
Define an IAM policy that denies access if the key age is more than three months and apply to all users.
C.
Write a script that uses the GenerateCredentialReport, GetCredentialReport, and UpdateAccessKey APIs.
D.
Create an Amazon CloudWatch alarm to detect aged access keys and use an AWS Lambda function to disable the keys older than 90 days.
The answer is C.
D is wrong. You cannot use "cloudwatch alarms" for this, it should be a "cloudwatch event rule".
You could totally write a script that uses the GenerateCredentialReport, GetCredentialReport, and UpdateAccessKey APIs. So, answer C is correct.
You can use a CloudWatch Events rule that matches on alarm evaluation changes and then triggers a Lambda function that parses the alarm event and creates a customized notification.
https://aws.amazon.com/blogs/mt/customize-amazon-cloudwatch-alarm-notifications-to-your-local-time-zone-part-1/#:~:text=You%20can%20use%20a%20CloudWatch,and%20creates%20a%20customized%20notification.
Correct Answer : D
Explanation:
Create a CloudWatch Alarm:
Set up a CloudWatch alarm to monitor the age of IAM access keys. CloudWatch allows you to create alarms based on custom metrics.
Define the Threshold:
Set the threshold for the alarm to trigger when access keys are older than three months (90 days).
Use an AWS Lambda function:
Configure the CloudWatch alarm to trigger an AWS Lambda function when the alarm state changes (e.g., when it breaches the threshold).
Lambda Function to Disable Keys:
In the Lambda function, use AWS SDK/APIs (such as listAccessKeys and updateAccessKey) to identify IAM users with access keys older than 90 days and disable those keys.
C- must be the correct one. There is no CW metric to analyze the credentials age, so no alarm can be triggered. You can configure an event bridge rule to tun a lambda on a regular basis. That lambda, using code, can check the age of the credentials and change them. It is True that in C I miss a cron to run the script automatically from time to time but...Another cool approach would be to use Config -> https://docs.aws.amazon.com/config/latest/developerguide/access-keys-rotated.html
I have passed the exam recently, and confirm that some questions on this site are word for word the same as the ones I have gotten in the exam. Which is a clear violation of the Amazon terms, so I will not comment on which ones exactly. However many answers on this site are comically bad, so at least the students still have some homework to do.
Also, I confirm that you are not given detailed results, so the guy who keeps saying "I had this question in my exam, answer is X" is a fool.
Not the best solution but possible to do it with AWS CloudWatch Alarm:
Create a CloudWatch metric filter: Create a CloudWatch metric filter that extracts the creation date of IAM user access keys.
Create a CloudWatch alarm: Create a CloudWatch alarm that triggers when the IAM user access key is more than three months old.
Set up an AWS Lambda function: Set up an AWS Lambda function to disable the access key when the CloudWatch alarm triggers.
Test the alarm: Test the CloudWatch alarm by generating some old IAM user access keys and verifying that they trigger the Lambda function to disable the access key.
Monitor the alarm: Monitor the CloudWatch alarm and the Lambda function to ensure that they are functioning correctly and that access keys are being disabled as expected.
A - No such option in available in AWS console
B - IAM policy defines the permission, nothing related to user’s credentials
C : This looks a right answer, but not meeting the automated process, Ref : https://docs.aws.amazon.com/cli/latest/reference/iam/update-access-key.html
D: This meets all the criteria.
I’ll go with D
Without any doubt its D. AWS will not have to tell you it's a Cloudwatch Event to choose the correct answer.
https://aws.amazon.com/blogs/mt/customize-amazon-cloudwatch-alarm-notifications-to-your-local-time-zone-part-1/#:~:text=You%20can%20use%20a%20CloudWatch,and%20creates%20a%20customized%20notification.
It's a vague question. C is missing trigger a need to mess with an API. Where in D, there's nothing like an age detection alarm. The only way i can imagine is to either use scheduled cloud watch event which will in turn trigger lambda with sdk and to the steps mentioned in c, or using AWS Config, triggering lambda as a remediation action.
https://docs.aws.amazon.com/IAM/latest/APIReference/API_UpdateAccessKey.html
This operation can be used to disable a user's key as part of a key rotation workflow.
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
hozefa
Highly Voted 3 years, 6 months agoJohnnieWalker
3 years, 3 months agoarae
2 years, 6 months agoTiwalade18
11 months, 1 week agoKdosec
3 years, 5 months agoszmulder
1 year, 5 months agotouryard
3 years, 6 months agoBillyC
Highly Voted 3 years, 7 months agorip72
3 years, 6 months agorip72
3 years, 6 months agoucsdmiami2020
3 years, 6 months agofrancisco_guerra
2 years, 8 months agoyd_h
2 years agogolf_life
Most Recent 3 months, 2 weeks agogafani3433
1 year, 2 months agoawssecuritynewbie
1 year, 6 months agopal40sg
1 year, 7 months agosprial02
1 year, 8 months agosprial02
1 year, 8 months agoKRtoptech
1 year, 8 months agoKitman
1 year, 11 months agoArvind_Kumar_Avinash
1 year, 11 months agomatrpro
1 year, 12 months agoHansD
2 years agopeddyua
2 years, 1 month agosandeep4537
2 years, 2 months agoBassell
2 years, 2 months agohubekpeter
2 years, 5 months agoboooliyooo
2 years, 5 months ago