Question

A company must enforce a policy that all IAM user access keys across 50 member accounts in AWS Organizations are automatically deactivated after 90 days and users notified. A DevOps engineer wants a centrally managed, event-driven solution that runs without deploying and maintaining code in every account. Which approach best meets these requirements with the least operational overhead?

Accepted Answer

Deploy an AWS Config managed rule (access-keys-rotated) via an organization Config rule from the delegated administrator account, and configure an automatic remediation action using an SSM Automation document that assumes a cross-account role to deactivate the key and publish an SNS notification.

Answer

Create a Lambda function in each member account triggered by an EventBridge schedule that calls IAM ListAccessKeys, deactivates keys older than 90 days, and sends email through SES.

Answer

Enable IAM Access Analyzer in the management account to detect old access keys and rely on its findings to automatically deactivate keys after 90 days.

Answer

Configure a Secrets Manager rotation schedule of 90 days for each IAM user's access key so the keys are rotated and old versions invalidated automatically.