An application currently uses an overly permissive IAM role that grants full access to all AWS services. The SysOps administrator needs to produce a policy that grants only the permissions the application actually requires. What steps should the administrator take to generate such a policy?

The correct approach is to enable AWS CloudTrail and then use IAM Access Analyzer to generate a least-privilege policy from recorded activity. CloudTrail logs all API calls and actions taken within your AWS account, providing the necessary data on what services and actions the application actually uses. IAM Access Analyzer can then analyze these CloudTrail logs to identify the specific permissions required, helping to create a finely-tuned, least-privilege IAM policy. Enabling CloudTrail and then using Security Hub is incorrect because Security Hub is for security posture management and compliance, not for generating IAM policies from activity logs. Enabling EventBridge (CloudWatch Events) and then using IAM Access Analyzer is incorrect because EventBridge focuses on event-driven architectures and routing events, not on logging API calls for policy generation. Running the get-generated-policy command directly in IAM Access Analyzer is incorrect because this command requires CloudTrail logs as input; it doesn't magically produce a policy without prior activity data.