DVA-C02 · Question #771
A company uses an AWS CloudFormation stack to deploy a serverless application that is based on AWS Lambda functions. The company uses Amazon CloudWatch, AWS CloudTrail, and Amazon Inspector to…
The correct answer is B. Run a drift detection check on the CloudFormation stack. AWS CloudFormation drift detection compares the current live configuration of stack resources with the expected configuration defined in the CloudFormation template. Running drift detection quickly identifies any manual changes made to IAM execution roles outside the stack…
Question
A company uses an AWS CloudFormation stack to deploy a serverless application that is based on AWS Lambda functions. The company uses Amazon CloudWatch, AWS CloudTrail, and Amazon Inspector to monitor activity in its AWS accounts. The company suspects that some developers have made manual modifications to the IAM execution roles for the Lambda functions outside of the CloudFormation stack. The changes have made the IAM execution roles overly permissive and less secure. The company needs a solution to review manual changes that the developers have made to the IAM execution roles. Which solution will meet this requirement in the MOST operationally efficient way?
Options
- AScan the CloudTrail logs. Look for iam:PutRolePolicy events.
- BRun a drift detection check on the CloudFormation stack.
- CView IAM configuration changes by using the Amazon Inspector history.
- DCreate a Lambda function to log IAM resource changes in response to Amazon EventBridge
How the community answered
(57 responses)- A11% (6)
- B81% (46)
- C5% (3)
- D4% (2)
Explanation
AWS CloudFormation drift detection compares the current live configuration of stack resources with the expected configuration defined in the CloudFormation template. Running drift detection quickly identifies any manual changes made to IAM execution roles outside the stack, making it the most operationally efficient way to detect unauthorized or unintended permission
Community Discussion
No community discussion yet for this question.