SAP-C02 Question 128

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose B1

  The best approach is to use IAM Access Analyzer with CloudTrail logging enabled. IAM Access Analyzer can automatically generate IAM policies based on actual API activity recorded in CloudTrail. This provides least-privilege IAM policies with minimal effort and is specifically designed for this use case. Other options require manual scripting or overcomplicated processing like EMR, making them less efficient.

• 1

  B. Turn on AWS CloudTrail logging for the AWS account. Use AWS Identity and Access Management Access Analyzer to generate IAM access policies based on the activity recorded in the CloudTrail log. Review the generated policies to ensure that they meet the company's business requirements.

• 1

  poor since B only works when functions are actually triggered and all the branches of the code are covered.