SAP-C02 Question 68
Select 2An organization is using multiple AWS accounts to isolate workloads and has enabled AWS Organizations. The security team wants to ensure all member accounts log their API activity to a centralized S3 bucket in the management account and also wants to identify any overly permissive IAM roles across all accounts. Which combination of AWS services should be used to achieve this?
- A
Use AWS CloudTrail to log API activity and configure it to deliver logs to a centralized S3 bucket in the management account.
- B
Enable AWS Security Hub in all member accounts to aggregate API activity logs into the management account.
- C
Use AWS Identity and Access Management (IAM) Access Analyzer to identify overly permissive IAM roles across all accounts.
- D
Set up Amazon Inspector to monitor API activity and detect overly permissive IAM roles.
- E
Enable AWS Config to track changes to resources and enable AWS Config rules to detect overly permissive IAM roles.
Show answer and explanation
Correct answers: A, C
Explanation
To meet the requirements, AWS CloudTrail should be used to log API activity centrally for all member accounts, and AWS IAM Access Analyzer should be used to detect overly permissive IAM roles. These tools are purpose-built for the specified tasks and align with best practices for centralized logging and identity management in a multi-account AWS environment.
- A. Correct.
AWS CloudTrail is the correct service for logging API activity across AWS accounts. By configuring the logs to be delivered to a centralized S3 bucket in the management account, the organization can meet the logging requirement.
- B. Incorrect.
AWS Security Hub is a security posture management tool that aggregates findings from multiple AWS services but does not directly log API activity or manage centralized logs.
- C. Correct.
AWS IAM Access Analyzer is designed to identify overly permissive IAM roles and policies. This directly addresses the requirement to find overly permissive roles across all accounts.
- D. Incorrect.
Amazon Inspector is used for vulnerability assessments and does not monitor API activity or analyze IAM roles for permissive policies.
- E. Incorrect.
While AWS Config can track resource changes and evaluate compliance with Config rules, it is not specifically designed to log API activity or identify overly permissive IAM roles as effectively as IAM Access Analyzer.