The environment uses IAM Identity Center for all users. The security team wants any new IAM user’s credentials disabled immediately and to receive a notification. Which combination of steps should be taken? (Choose three)
Choose an answer
Tap an option to check your answer.
Correct answer: Create an Amazon EventBridge rule that reacts to an IAM CreateUser API call in AWS CloudTrail., Create an AWS Lambda function that is a target of the EventBridge rule. Configure the Lambda function to disable any access keys and delete the login profiles that are associated with the IAM user., Create an Amazon Simple Notification Service (Amazon SNS) topic that is a target of the EventBridge rule. Subscribe the security team's group email address to the topic..
Why this is the answer
An Amazon EventBridge rule triggered by the CreateUser API call in CloudTrail is essential to detect new IAM user creation. This ensures immediate action. The AWS Lambda function, as a target of the EventBridge rule, is necessary to programmatically disable access keys and delete login profiles, effectively disabling the user's credentials. An Amazon SNS topic, also a target of the EventBridge rule, provides a mechanism to notify the security team via email. GetLoginProfile is incorrect because it tracks login profile retrieval, not user creation. A Lambda function that only deletes login profiles is insufficient as it doesn't disable access keys. An SQS queue for notifications is less direct for email notifications than SNS, which is designed for fan-out messaging to various subscribers, including email.
Pass your exam — without the endless answer hunt
Get every verified question and explanation for this exam in one place, and save hours of prep. 1,000+ certifications · 20+ languages · free to start.
Pass your exam faster → No card needed