Q99 — AWS SAA-C03 Ch.13

Question 99 of 100 | ← Chapter 13

Q999. A company runs all its business applications in the AWS Cloud. The company uses AWS Organizations to manage multiple AWS accounts.A solutions architect needs to review all permissions that are granted to IAM users to determine which IAM users have more permissions than required.Which solution will meet these requirements with the LEAST administrative overhead?

• A. Use Network Access Analyzer to review all access permissions in the company's AWS accounts.
• B. Create an AWS CloudWatch alarm that activates when an IAM user creates or modifies resources in an AWS account.
• C. Use AWS Identity and Access Management (IAM) Access Analyzer to review all the company resources and accounts. ✓
• D. Use Amazon Inspector to find vulnerabilities in existing IAM policies.

Correct Answer: C. Use AWS Identity and Access Management (IAM) Access Analyzer to review all the company resources and accounts.

Explanation

To review all permissions granted to IAM users and determine which IAM users have more permissions than required with the least administrative overhead, the best solution is:C. Use AWS Identity and Access Management (IAM) Access Analyzer to review all the company resources and accounts.Explanation:IAM Access Analyzer: This tool helps you identify resources in your AWS environment that are shared with external entities and analyzes resource-based policies to determine which IAM users have access to those resources. It provides insights into permissions granted, making it easier to identify permissions that may be excessive.Evaluation of Other Options:A. Use Network Access Analyzer: This tool focuses on network access and configuration rather than IAM permissions. It is not designed to review IAM user permissions.B. Create an AWS CloudWatch alarm...: This approach would require significant manual setup and would only notify you of modifications or creations, not provide a comprehensive review of existing permissions.D. Use Amazon Inspector: Amazon Inspector is primarily used for assessing the security of applications and finding vulnerabilities in EC2 instances and container images. It does not specifically analyze IAM permissions.In summary, Option C is the most effective and efficient solution for reviewing IAM user permissions with minimal administrative overhead.