A CloudOps engineer must manage the security of an AWS account. Recently, an IAM user's access key was mistakenly uploaded to a public code repository. The engineer must identify everything that was c

Question

Options

• ACreate an Amazon EventBridge rule to send all IAM events to an AWS Lambda function for
• BQuery Amazon EC2 logs by using Amazon CloudWatch Logs Insights for all events initiated with
• CSearch AWS CloudTrail event history for all events initiated with the compromised access key
• DSearch VPC Flow Logs for all events initiated with the compromised access key within the

• A
  6% (1)
• B
  17% (3)
• C
  72% (13)
• D
  6% (1)

Explanation

According to the AWS Cloud Operations and Security documentation, AWS CloudTrail is the authoritative service for recording API activity across all AWS services within an account. When an access key is compromised, CloudTrail logs all API requests made using that key, including details such as: The user identity (access key ID) that made the request, The service, operation, resource, and timestamp affected, and The source IP address and region of the request. By searching the CloudTrail event history for the specific access key ID, the CloudOps engineer can identify every action performed by that key during the suspected breach window.

No community discussion yet for this question.