nerdexam
Amazon

SOA-C03 · Question #109

A company has multiple AWS accounts. A CloudOps engineer uses a sandbox account to create and verify IAM policies for use in a production account. The CloudOps engineer uses AWS CloudFormation to depl

The correct answer is B. Create an Amazon EventBridge rule to invoke an AWS Lambda function to check the. CloudFormation drift detection is designed to detect any configuration changes made outside CloudFormation (such as manual edits to IAM policies). By wiring CloudTrail → EventBridge → Lambda → Drift Detection → SNS, you automatically trigger drift checks when relevant changes occ

Submitted by hassan_iq· Mar 5, 2026Monitoring, logging, and remediation

Question

A company has multiple AWS accounts. A CloudOps engineer uses a sandbox account to create and verify IAM policies for use in a production account. The CloudOps engineer uses AWS CloudFormation to deploy policies to the sandbox account for testing. When tests pass, the CloudOps engineer deploys the policies to production. The CloudOps engineer has configured AWS CloudTrail in both the sandbox account and the production account. The CloudOps engineer wants to detect any changes to the IAM policies after the policies have been deployed by CloudFormation. The CloudOps engineer must receive notifications for any changes to the policies. Which solution will meet these requirements with the LEAST administrative effort?

Options

  • AConfigure CloudTrail to send email notifications to the CloudOps engineer when CloudTrail
  • BCreate an Amazon EventBridge rule to invoke an AWS Lambda function to check the
  • CUse AWS Identity and Access Management Access Analyzer to generate a policy based on
  • DStore the IAM policies as a JSON document in an Amazon S3 bucket. Use an AWS Lambda

How the community answered

(33 responses)
  • A
    3% (1)
  • B
    79% (26)
  • C
    6% (2)
  • D
    12% (4)

Explanation

CloudFormation drift detection is designed to detect any configuration changes made outside CloudFormation (such as manual edits to IAM policies). By wiring CloudTrail → EventBridge → Lambda → Drift Detection → SNS, you automatically trigger drift checks when relevant changes occur and notify the CloudOps engineer if the actual IAM policies differ from the CloudFormation template. This leverages managed services and avoids building your own comparison logic, providing the least administrative effort among the options.

Topics

#CloudTrail#EventBridge#IAM policy monitoring#Lambda

Community Discussion

No community discussion yet for this question.

Full SOA-C03 Practice