AWS Certified Security - Specialty SCS-C02 — Topic 1 Question 177

Question

A security engineer is designing an IAM policy for a script that will use the AWS CLI. The script currently assumes an IAM role that is attached to three AWS managed IAM policies: AmazonEC2FullAccess, AmazonDynamoDBFullAccess, and AmazonVPCFullAccess. The security engineer needs to construct a least privilege IAM policy that will replace the AWS managed IAM policies that are attached to this role. Which solution will meet these requirements in the MOST operationally efficient way?

Accepted Answer

Correct answer: A. The correct answer is A. Option A: In AWS CloudTrail, create a trail for management events. Run the script with the existing AWS managed IAM policies. Use IAM Access Analyzer to generate a new IAM policy that is based on access activity in the trail. R... AWS IAM controls authenticated and authorized access to AWS resources with fine-grained policies. AWS CloudTrail records API activity for auditing and governance.

AWS Certified Security - Specialty SCS-C02 — Question 177