A company wants to receive an email notification when IAM users are added to or deleted from an AWS account.
Which solution will meet these requirements?
A.
Enable Amazon Inspector. Create an Amazon EventBridge rule that responds to Amazon Inspector findings. Set the target as an Amazon SNS topic. Set the company ' s email address as a subscriber to the SNS topic.
B.
Enable Amazon GuardDuty. Create an Amazon EventBridge rule that responds to GuardDuty findings. Configure an event pattern of Impact:IAMUser/AnomalousBehavior. Set the target as an Amazon SNS topic. Set the company’s email address as a subscriber to the SNS topic.
C.
Enable Amazon Macie. Create an Amazon EventBridge rule that responds to Macie findings. Set the target as an Amazon SNS topic. Set the company’s email address as a subscriber to the SNS topic.
D.
Enable management events in AWS CloudTrail. Create an Amazon EventBridge rule that responds to AWS API calls through CloudTrail. Configure an event pattern for CreateUser and DeleteUser actions. Set the target as an Amazon SNS topic. Set the company’s email address as a subscriber to the SNS topic.
IAM user creation and deletion are AWS API management events. CloudTrail records management events such as IAM CreateUser and DeleteUser API calls. EventBridge can match these CloudTrail events with an event pattern and route the matching events to an Amazon SNS topic. Subscribing the company’s email address to the SNS topic provides the required email notification. Amazon Inspector is for vulnerability and exposure findings, not IAM account-change monitoring. GuardDuty can detect suspicious IAM behavior, but it is not the correct service for deterministic notifications every time a user is created or deleted. Amazon Macie is focused on sensitive data discovery and data security findings in services such as Amazon S3, not IAM lifecycle events.
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit