Q13 — AWS SAA-C03 Ch.17

Question 13 of 89 | ← Chapter 17

Q1313. A company uses AWS CloudFormation to deploy IAM resources within accounts that AWS Control Tower governs. The security team wants to prevent the deployment of IAM roles that include inline policies with the following statements:"Effect":"Allow","Action":"","Resource":""Which solution will meet this requirement?

Correct Answer: D. Use AWS Config to create a rule that detects these statements in inline IAM policies and sends a notification to the security team.

Explanation

The correct solution to prevent the deployment of IAM roles with overly permissive inline policies (allowing "" actions on "" resources) is:D. Use AWS Config to create a rule that detects these statements in inline IAM policies and sends a notification to the security team.Why Option D is Correct:AWS Config for Compliance MonitoringAWS Config can detect IAM inline policies containing the forbidden statement ("Effect": "Allow", "Action":"", "Resource": "") using a custom rule (via AWS Lambda) or a managed rule (if available). Upon detection, it can trigger an Amazon SNS notification to alert the security team, enabling proactive remediation before unauthorized access occurs.Preventive vs. Detective ControlsAWS Control Tower proactive controls (Option A) cannot directly block CloudFormation deployments based on IAM policy content. Control Tower enforces guardrails (e.g., blocking public S3 buckets), but not granular IAM policy checks.AWS Control Tower detective controls (Option B) identify violations post-deployment but do not automatically delete policies--they only generate alerts.AWS Config's remediation (Option C) (e.g., AWS-DeleteIAMInlinePolicy) can delete policies, but this is reactive and may cause service disruptions if roles lose required permissions.Security Best PracticeNotify first, remediate later: Alerting the security team allows them to review and manually adjust policies, ensuring no legitimate permissions are accidentally removed. Audit trail: AWS Config maintains a history of compliance checks, aiding in forensic analysis.Why Other Options Are Incorrect:A. AWS Control Tower Proactive ControlsControl Tower's proactive guardrails (e.g., Service Control Policies (SCPs)) can block actions at the account/OU level, but they cannot inspect inline IAM policies in CloudFormation templates. Example: An SCP could block iam:CreateRole entirely, but not selectively block roles with "" permissions.B. AWS Control Tower Detective ControlsDetective controls (e.g., AWS Config rules integrated with Control Tower) detect violations but do not automatically delete policies.Remediation requires manual intervention or external automation (e.g., Lambda).C. AWS Config with Auto-RemediationWhile AWS Config can delete inline policies via remediation, this is risky for production environments. Overly permissive policies might be intentional (e.g., for break-glass scenarios), and automatic deletion could cause outages.Implementation Steps for Option D:Create an AWS Config RuleUse a custom AWS Config rule (Lambda-backed) to scan IAM inline policies for the forbidden statement.Example Lambda logic (pseudo-code):pythonimport jsondef lambda_handler(event, context):policy_document = json.loads(event['detail']['requestParameters']['policyDocument']) for statement in policy_document['Statement']:if (statement['Effect'] == 'Allow' andstatement['Action'] == '' andstatement['Resource'] == ''):# Trigger SNS alertsend_sns_notification("Forbidden IAM policy detected!")return {"compliance": "NON_COMPLIANT"}return {"compliance": "COMPLIANT"}Configure SNS NotificationCreate an SNS topic and subscribe the security team's email/Slack channel. Link the SNS topic to the AWS Config rule's non-compliance notifications.Optional: Integrate with AWS Security HubForward AWS Config findings to Security Hub for centralized security management.Alternative (More Proactive Approach):If the company wants to block deployments entirely, combine:AWS IAM Access Analyzer (pre-deployment validation) with CloudFormation hooks to scan templates for forbidden policies.AWS Service Catalog to restrict IAM role deployments to pre-approved templates. However, Option D is the most straightforward and secure solution for the given requirements.Conclusion:Option D is the best choice because it detects risky policies and alerts the security team without risking accidental permission loss or requiring unsupported Control Tower features.