A security engineer is designing an IAM policy for a script that will use the AWS CLI. The script currently assumes an IAM role that is attached to three AWS managed IAM policies…

Question

Options

• AIn AWS CloudTrail, create a trail for management events. Run the script with the existing AWS
• BRemove the existing AWS managed IAM policies from the role. Attach the IAM Access Analyzer
• CCreate an account analyzer in IAM Access Analyzer. Create an archive rule that has a filter that
• DIn AWS CloudTrail, create a trail for management events. Remove the existing AWS managed

• A
  49% (25)
• B
  8% (4)
• C
  29% (15)
• D
  14% (7)

Explanation

Option A is correct because IAM Access Analyzer's policy generation feature uses CloudTrail management event logs to analyze the API calls a role actually makes, then automatically generates a least-privilege policy reflecting only those actions - this is far more efficient than manually auditing permissions. The workflow is: enable CloudTrail → run the script under existing broad permissions → let Access Analyzer generate a scoped-down policy from the observed activity.

Why the distractors fail:

• B removes the broad policies before capturing usage, so the script can't run and no activity is logged - you have nothing to analyze.
• C confuses two different Access Analyzer features; account analyzers with archive rules are for detecting external access to resources, not for generating least-privilege policies from usage logs.
• D similarly removes the managed policies prematurely - without them, the script fails and CloudTrail captures nothing useful.

Memory tip: Think "capture, then cut" - you must observe actual usage first (CloudTrail + existing broad permissions), then use Access Analyzer to trim to what was actually called. Any option that removes permissions before observation is backwards and wrong.

No community discussion yet for this question.