Question

A CloudOps engineer is tasked with tightening IAM permissions across a single AWS account. The security team wants to identify IAM roles and users that have permissions they have not used in the last 90 days, so those excess permissions can be removed to enforce least privilege. The engineer wants a native, low-maintenance AWS solution that automatically surfaces these findings without writing custom scripts to parse logs. Which approach should the engineer implement?

Accepted Answer

Enable IAM Access Analyzer with an unused access analyzer, then review the generated findings for unused roles, permissions, and access keys.

Answer

Enable an IAM Access Analyzer external access analyzer to detect resources shared outside the account and remove any unused permissions it reports.

Answer

Create an AWS Config rule that evaluates IAM policy documents and flags any policy granting more than read-only access.

Answer

Write a Lambda function that parses CloudTrail management events daily to build a report of each principal's last-used actions.