Question

A company uses AWS IAM Identity Center (successor to AWS SSO) with permission sets federated from an external identity provider. A compliance auditor requires that all human access to production accounts must automatically expire after a maximum of 1 hour and that every console and CLI action performed through federated access is captured in a tamper-evident, centrally aggregated audit trail. Currently, permission sets grant an 8-hour session and CloudTrail is enabled only in each member account. Which combination of changes BEST meets these requirements with the least ongoing operational effort?

Accepted Answer

Reduce the session duration on the relevant permission sets to 1 hour, and configure an organization trail in AWS CloudTrail that delivers events from all accounts to a central S3 bucket with log file validation enabled.

Answer

Write a Lambda function triggered every hour by EventBridge to revoke active IAM Identity Center sessions, and enable CloudTrail Insights in each member account.

Answer

Set the maximum session duration on the IAM roles that Identity Center provisions in each account to 1 hour manually, and configure S3 server access logging on each account's individual CloudTrail bucket.

Answer

Attach a permissions boundary limiting session length to 1 hour to each permission set, and enable AWS Config in all accounts to record IAM changes.