AWS Certified Security - Specialty SCS-C02 — Topic 1 Question 134

Question

A company uses an external identity provider to allow federation into different AWS accounts. A security engineer for the company needs to identify the federated user that terminated a production Amazon EC2 instance a week ago. What is the FASTEST way for the security engineer to identify the federated user?

Accepted Answer

Correct answer: B. The correct answer is B. Option B: Filter the AWS CloudTrail event history for the TerminateInstances event and identify the assumed IAM role. Review the AssumeRoleWithSAML event call in CloudTrail to identify the corresponding username. An IAM role grants temporary, least-privilege permissions to AWS resources without long-term credentials. AWS IAM controls authenticated and authorized access to AWS resources with fine-grained policies. AWS CloudTrail records API activity for auditing and governance.

AWS Certified Security - Specialty SCS-C02 — Question 134