DOP-C02 · Question #35
A DevOps engineer at a company is supporting an AWS environment in which all users use AWS IAM Identity Center (AWS Single Sign-On). The company wants to immediately disable credentials of any new…
The correct answer is A. Create an Amazon EventBridge rule that reacts to an IAM CreateUser API call in AWS C. Create an AWS Lambda function that is a target of the EventBridge rule. Configure the Lambda E. Create an Amazon Simple Notification Service (Amazon SNS) topic that is a target of the. To automatically disable new IAM user credentials and notify the security team, create an EventBridge rule that detects CreateUser API calls. This rule should trigger a Lambda function to perform the disabling action and concurrently publish a notification to an SNS topic.
Question
A DevOps engineer at a company is supporting an AWS environment in which all users use AWS IAM Identity Center (AWS Single Sign-On). The company wants to immediately disable credentials of any new IAM user and wants the security team to receive a notification. Which combination of steps should the DevOps engineer take to meet these requirements? (Choose three.)
Options
- ACreate an Amazon EventBridge rule that reacts to an IAM CreateUser API call in AWS
- BCreate an Amazon EventBridge rule that reacts to an IAM GetLoginProfile API call in AWS
- CCreate an AWS Lambda function that is a target of the EventBridge rule. Configure the Lambda
- DCreate an AWS Lambda function that is a target of the EventBridge rule. Configure the Lambda
- ECreate an Amazon Simple Notification Service (Amazon SNS) topic that is a target of the
- FCreate an Amazon Simple Queue Service (Amazon SQS) queue that is a target of the Lambda
How the community answered
(26 responses)- A73% (19)
- B15% (4)
- D8% (2)
- F4% (1)
Why each option
To automatically disable new IAM user credentials and notify the security team, create an EventBridge rule that detects `CreateUser` API calls. This rule should trigger a Lambda function to perform the disabling action and concurrently publish a notification to an SNS topic.
An Amazon EventBridge rule can be configured to detect specific AWS API calls, such as `iam:CreateUser` via CloudTrail, providing the necessary trigger for automation when a new IAM user is created.
The `iam:GetLoginProfile` API call is used to retrieve an existing user's login profile, not to detect the creation event of a new IAM user.
An AWS Lambda function serves as an ideal target for the EventBridge rule, allowing custom code execution to programmatically disable the newly created IAM user's credentials, for example, by deleting their login profile or access keys.
A Lambda function configured to create an IAM role does not fulfill the requirement of disabling credentials for a new IAM user; it performs an entirely different administrative action.
An Amazon Simple Notification Service (SNS) topic can be configured as another target of the EventBridge rule, ensuring the security team receives an immediate notification whenever a new IAM user is detected as created.
An Amazon Simple Queue Service (SQS) queue is a message queuing service for decoupling applications and does not directly provide a notification mechanism for human users or teams like Amazon SNS.
Concept tested: Event-driven automation for IAM security with EventBridge, Lambda, SNS
Source: https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-troubleshooting-events.html
Topics
Community Discussion
No community discussion yet for this question.