SAA-C03 Q659 · Security

Question

A security team needs to enforce the rotation of all IAM users' access keys every 90 days. If an access key is found to be older, the key must be made inactive and removed. A solutions architect must create a solution that will check for and remediate any keys older than 90 days. Which solution meets these requirements with the LEAST operational effort?

Accepted Answer

Option C combines two purpose-built AWS services optimally:

1. **AWS Config rule for detection**: AWS Config has a **built-in managed rule** called `access-keys-rotated` that natively checks IAM access key age against a configurable maximum (e.g., 90 days). This is zero-code detection — you simply enable the rule and set the parameter.

2. **Amazon EventBridge for orchestration**: When AWS Config detects a non-compliant resource, it publishes a compliance change event to EventBridge. An EventBridge rule can trigger on this specific event pattern (`compliance-type: NON_COMPLIANT`).

3. **AWS Lambda for remediation**: Lambda is the ideal serverless compute for this task — deactivating and deleting an IAM access key is a lightweight API call (`iam:UpdateAccessKey`, `iam:DeleteAccessKey`). La

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

💰 Cost

🔒 Security

🎯 Exam Tips