A company's security team needs to receive a notification whenever an AWS access key has not been rotated in 90 or more days. A security engineer must develop a solution that provides these…

The access-keys-rotated AWS Config managed rule is a built-in periodic rule that checks whether active access keys have been rotated within a configurable number of days (default 90), and integrating it with an SNS notification via Config requires only enabling the rule and setting up a Config notification channel, minimizing engineering effort.

Exporting a CSV from Trusted Advisor and scripting around it requires custom automation and does not provide native integration with a notification pipeline, requiring more ongoing effort.

Downloading the IAM credentials report and parsing it in a Lambda function is a viable approach but requires custom code development, scheduling, and maintenance, representing more effort than the managed rule.

Building a custom Lambda to iterate all IAM users and check key ages requires writing, deploying, scheduling, and maintaining code, which is significantly more effort than using a managed Config rule.