Exam AWS DevOps Engineer Professional topic 1 question 80 discussion

For option C we need Step Function to trigger the Lambda function, as can be seen in the provided links bellow. Step Functions are not mentioned in answer C, so the only valid option would be D

https://docs.aws.amazon.com/AmazonCloudWatch/latest/events/EventTypes.html

A - there are no actions for Cloudwatch Logs metric filter B - AWS Config is not relevant for this use case as it monitors resources status/compliance C - There is no such thing Health dashboard event rule, need to use cloudwatch event rule D - Correct

D: EventBridge Pattern { "source": ["aws.health"], "detail-type": ["AWS Health Event"], "detail": { "service": ["RISK"], "eventTypeCategory": ["issue"], "eventTypeCode": ["AWS_RISK_CREDENTIALS_EXPOSED", "AWS_RISK_CREDENTIALS_COMPROMISED", "AWS_RISK_CREDENTIALS_EXPOSURE_SUSPECTED", "AWS_RISK_CREDENTIALS_COMPROMISE_SUSPECTED"] } }

There are two issues with C It should use event bridge which is not mentioned It is aws.health event not the health dashboard event

I correct myself, it's not C because the event should be coming from aws health events. not health dashboard events

Looks to me to be C. https://github.com/aws/aws-health-tools/blob/master/automated-actions/AWS_RISK_CREDENTIALS_EXPOSED/README.md

D is correct. C is not because AWS health does not work with Trusted Advisor and the question talks about detecting credentials using AWS trusted advisor.

D for sure https://github.com/aws/Trusted-Advisor-Tools/blob/master/ExposedAccessKeys/README.md

I was initially leaning toward C. But the wording says "Create an AWS Personal Health Dashboard rule". The rule is technically created in EventBridge. For that reason I'd go with D.

https://aws.amazon.com/blogs/compute/automate-your-it-operations-using-aws-step-functions-and-amazon-cloudwatch-events/

I will go with C. Public access key <--> AWS Health <--> Event Bridge <--> Lambda Func. Refer: https://aws.amazon.com/blogs/compute/automate-your-it-operations-using-aws-step-functions-and-amazon-cloudwatch-events/

D is correct

C is true https://aws.amazon.com/blogs/compute/automate-your-it-operations-using-aws-step-functions-and-amazon-cloudwatch-events/

D - Seems to be the right one. But wording around Exposed Access Key status is kinda wrong. Status should be error and check-name should be Exposed Access Key. https://github.com/aws/Trusted-Advisor-Tools/tree/master/ExposedAccessKeys C is also doable, but I don't think this is the case. https://www.examtopics.com/discussions/amazon/view/4893-exam-aws-devops-engineer-professional-topic-1-question-64/