SAA-C03 Q14 · Security

Question

A security team needs to enforce rotation of all IAM users' access keys every 90 days. Keys older than 90 days must be automatically deactivated and removed. A solutions architect must create a remediation solution with minimal operational effort. Which solution meets these requirements?

Accepted Answer

Option C uses the right tool for each job:

**1. AWS Config rule for compliance checking:**
- AWS Config has a **managed rule** called `access-keys-rotated` that checks whether active IAM access keys are rotated within a specified number of days.
- Config continuously evaluates resources against rules — it's purpose-built for compliance monitoring.
- When a key exceeds 90 days, Config marks the resource as **NON_COMPLIANT**.

**2. EventBridge rule for event-driven triggering:**
- AWS Config publishes compliance change events to EventBridge automatically.
- An EventBridge rule can listen for `Config Rules Compliance Change` events where the compliance status is `NON_COMPLIANT`.
- This creates an event-driven pipeline: Config detects → EventBridge routes → action executes.

**3. AWS Lambda f

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

💰 Cost

🔒 Security

🎯 Exam Tips