A security team needs automatic alerts when any AWS access key is older than 90 days without rotation. What is the simplest solution to implement?

The AWS Config managed rule access-keys-rotated is specifically designed to detect access keys that have not been rotated within a specified period. By setting maxAccessKeyAge to 90, AWS Config automatically evaluates compliance. When a key is found to be non-compliant, AWS Config generates an evaluation event. An Amazon EventBridge rule can then easily capture these NONCOMPLIANT events and trigger an Amazon SNS topic to notify the security team. This is the simplest and most integrated solution as it leverages existing AWS services built for this exact purpose. The other options involve more complex custom scripting, manual file processing, or querying, which are less efficient and more prone to errors compared to the managed AWS Config rule. For example, using AWS Trusted Advisor requires manual interaction or complex automation to extract data, and directly querying ListAccessKeys does not provide the "last rotated" information needed for this specific requirement.