DVA-C02 · Question #322
A company needs to deploy all its cloud resources by using AWS CloudFormation templates. A developer must create an Amazon Simple Notification Service (Amazon SNS) automatic notification to help enfor
The correct answer is D. Create an Amazon EventBridge rule to filter events from CloudTrail if a role was created without. Option D is correct because Amazon EventBridge is the native, serverless, event-driven service designed to filter and route CloudTrail events in near real-time - you can write a rule that matches CreateRole API calls where the invokedBy field is not cloudformation.amazonaws.com,
Question
A company needs to deploy all its cloud resources by using AWS CloudFormation templates. A developer must create an Amazon Simple Notification Service (Amazon SNS) automatic notification to help enforce this rule. The developer creates an SNS topic and subscribes the email address of the company's security team to the SNS topic. The security team must receive a notification immediately if an IAM role is created without the use of CloudFormation. Which solution will meet this requirement?
Options
- ACreate an AWS Lambda function to filter events from CloudTrail if a role was created without
- BCreate an AWS Fargate task in Amazon Elastic Container Service (Amazon ECS) to filter events
- CLaunch an Amazon EC2 instance that includes a script to filter events from CloudTrail if a role
- DCreate an Amazon EventBridge rule to filter events from CloudTrail if a role was created without
How the community answered
(32 responses)- A13% (4)
- B3% (1)
- C6% (2)
- D78% (25)
Explanation
Option D is correct because Amazon EventBridge is the native, serverless, event-driven service designed to filter and route CloudTrail events in near real-time - you can write a rule that matches CreateRole API calls where the invokedBy field is not cloudformation.amazonaws.com, then set the SNS topic as the target for immediate notification with zero infrastructure to manage.
Why the distractors fall short:
- A (Lambda) is close but inverted - Lambda is a target for EventBridge, not a filtering mechanism on its own. You'd still need EventBridge to capture and forward the event to Lambda, making D the more direct and complete solution.
- B (Fargate/ECS) introduces container orchestration overhead that is entirely unnecessary for a simple event-filter-and-notify workflow; it's over-engineered and not event-driven by default.
- C (EC2 instance with a script) requires managing and running a persistent server just to poll or filter events - this is the least efficient approach and violates the "immediate notification" requirement due to polling delays.
Memory tip: Think of EventBridge as the "traffic cop" for AWS events - it watches CloudTrail in real time and routes matching events directly to SNS, Lambda, or other targets. Whenever a question mentions "immediately notify when X AWS action happens," EventBridge → SNS is almost always the answer.
Topics
Community Discussion
No community discussion yet for this question.