SAP-C02 Practice Question 81: Unused Access Analyzer Organization
AWS Certified Solutions Architect – Professional (SAP-C02) · Test 9 · question 1 of 10
A company with 80 AWS accounts in an AWS Organization wants to move toward least privilege. Over the years, teams have created IAM roles, IAM users with access keys and broad permissions that may no longer be used. The security team wants a single, organization-wide view of roles, access keys, passwords and specific service permissions that have not been used for 90 days. They do not want to enable and manage a separate analysis in each account, and they do not want to work from the management account day to day.
Which solution meets these requirements?
Show answer and explanation
Answer:
IAM Access Analyzer's unused access analysis produces findings for unused roles, unused IAM user access keys and passwords, and unused service-level and action-level permissions. When you create an unused access analyzer you enter a *tracking period* between 1 and 365 days, and findings are generated for identities that show no usage during that period. It is available at the organization level through a delegated administrator account, so the security team can review findings for all 80 accounts from one place without working in the management account (option B).
- A is wrong because the credential report lists users' passwords and access keys only. It does not cover roles or unused service permissions, and comparing reports by hand does not scale. - C is wrong because absence of events in CloudTrail Lake would have to be inferred by custom queries in every account, and it says nothing about which granted permissions were never used. - D is wrong because GuardDuty detects threats and anomalous behavior. It is not a tool for finding unused permissions.
Reference: Create an IAM Access Analyzer unused access analyzer