Exam AWS Certified Security - Specialty SCS-C02 topic 1 question 177 discussion

The most operationally efficient way to construct a least privilege IAM policy for the script is Option A: A. In AWS CloudTrail, create a trail for management events. Run the script with the existing AWS managed IAM policies. Use IAM Access Analyzer to generate a new IAM policy that is based on access activity in the trail. Replace the existing AWS managed IAM policies with the generated IAM policy for the role. AWS CloudTrail logs all API calls, which provides a comprehensive record of the actions performed by the script. IAM Access Analyzer can analyze these logs to automatically generate a least privilege policy based on the actual access patterns1. This minimizes the manual effort required to identify necessary permissions. This approach ensures that the new policy includes only the permissions that are actually used, adhering to the principle of least privilege.

A https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-policy-generation.html

Option A provides the most operationally efficient solution by leveraging AWS CloudTrail to log access activity and IAM Access Analyzer to automatically generate a least privilege policy based on that activity. This approach minimizes manual intervention and ensures that the resulting IAM policy grants only the permissions necessary for the script to function, adhering to the principle of least privilege.