Question

A security team must be alerted within seconds whenever any IAM policy is attached to a user, group, or role across a single account. They already have an organization CloudTrail delivering management events to an S3 bucket and to a CloudWatch Logs log group. The team wants the lowest-latency, most operationally efficient way to trigger an SNS notification when these specific API calls occur. Which approach best meets the requirement?

Accepted Answer

Create an EventBridge rule that matches the AttachUserPolicy, AttachGroupPolicy, and AttachRolePolicy CloudTrail events and targets an SNS topic.

Answer

Create a CloudWatch Logs metric filter on the log group for the policy-attach events, publish a metric, and configure a CloudWatch alarm that notifies SNS.

Answer

Schedule an Athena query every minute against the CloudTrail S3 bucket and send results to SNS when matches are found.

Answer

Enable CloudTrail Insights to detect the policy-attach events and route Insights findings to SNS.