A company wants to receive automated email notifications when AWS access keys from developer AWS accounts are detected on code repository sites.
Which solution will provide the required email notifications?
A.
Create an Amazon EventBridge rule to send Amazon Simple Notification Service (Amazon SNS) email notifications for Amazon GuardDuty UnauthorizedAccess:IAMUser/lnstanceCredentialExfiltration.OutsideAWS findings.
B.
Change the AWS account contact information for the Operations type to a separate email address. Periodically poll this email address for notifications.
C.
Create an Amazon EventBridge rule that reacts to AWS Health events that have a value of Risk for the service category. Configure email notifications by using Amazon Simple Notification Service (Amazon SNS).
D.
Implement new anomaly detection software. Ingest AWS CloudTrail logs. Configure monitoring for ConsoleLogin events in the AWS Management Console. Configure email notifications from the anomaly detection software.
C - AWS Health focuses on service status & planned changes.
Correct answer is A - GuardDuty can detect exposed credentials and generates the finding UnauthorizedAccess and send the event to EventBridge to trigger the SNS.
Correct Answer:
A. Create an Amazon EventBridge rule to send Amazon Simple Notification Service (Amazon SNS) email notifications for AWS Health events with the eventTypeCode AWS_RISK_CREDENTIALS_EXPOSED.
Not C.
Create an Amazon EventBridge rule that reacts to AWS Health events that have a value of Risk for the service category. Configure email notifications by using Amazon Simple Notification Service (Amazon SNS).
While this captures a broader range of events, it may lead to unnecessary notifications. Focusing specifically on the AWS_RISK_CREDENTIALS_EXPOSED event ensures that alerts are relevant to exposed credentials.
The Answer is C, here is a similar solution:
https://github.com/aws/aws-health-tools/blob/master/automated-actions/AWS_RISK_CREDENTIALS_EXPOSED/README.md
Answer cannot be A because referenced finding type is exclusive to EC2 instance profiles, and is triggered only if instance session credentials are actually being used to authenticate as the instance.
https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-iam.html#unauthorizedaccess-iam-instancecredentialexfiltrationoutsideaws
Option A is the correct solution because it leverages Amazon GuardDuty to detect unauthorized use or exposure of AWS access keys and uses Amazon EventBridge along with Amazon SNS to provide automated email notifications, efficiently meeting the requirement with the least effort.
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
phmeeeee
3 weeks, 5 days agoAWSLoverLoverLoverLoverLover
2 months, 1 week agoWardove
3 months, 1 week agoyouonebe
3 months, 3 weeks agoSCSC02Q
4 months agoVPNalumni
6 months, 3 weeks agomikelord
7 months ago