AWS Certified DevOps Engineer - Professional DOP-C02 — Topic 1 Question 71

Question

A DevOps engineer at a company is supporting an AWS environment in which all users use AWS IAM Identity Center (AWS Single Sign-On). The company wants to immediately disable credentials of any new IAM user and wants the security team to receive a notification. Which combination of steps should the DevOps engineer take to meet these requirements? (Choose three.)

Accepted Answer

Correct answer: A, C, E. The correct answer is A, C, E. Option A: Create an Amazon EventBridge rule that reacts to an IAM CreateUser API call in AWS CloudTrail. Option C: Create an AWS Lambda function that is a target of the EventBridge rule. Configure the Lambda function to disable any access keys and delete the login profiles that are associated with the IAM user. Option E: Create an Amazon Simple Notification Service (Amazon SNS) topic that is a target of the EventBridge rule. Subscribe the security team's group email address to the topic. AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. Amazon SNS is a managed pub/sub service for fan-out notifications to many subscribers. Amazon EventBridge routes events between services with rules, enabling event-driven, decoupled architectures.

AWS Certified DevOps Engineer - Professional DOP-C02 — Question 71