Examkin

Soru

Zorluk: ZorSecurity Monitoring, Logging, and Compliance Auditing

A SysOps Administrator is implementing a security monitoring solution to detect whenever an AWS Identity and Access Management (IAM) access key is created or updated. The administrator configures an Amazon EventBridge rule in the eu-west-1 region with an Amazon Simple Notification Service (Amazon SNS) topic as the target. Although IAM access keys are being created and updated, the security team is not receiving any SNS notifications. Which of the following configurations should the SysOps Administrator implement to resolve this issue? (Select TWO.)

  1. Recreate the Amazon EventBridge rule in the us-east-1 (US East (N. Virginia)) region.Cevap
  2. Ensure that an active AWS CloudTrail trail is configured to capture global service events.Cevap
  3. C
    Enable Amazon CloudWatch detailed monitoring for the IAM service.
  4. D
    Attach an IAM policy to the EventBridge rule containing the iam:PassRole permission.
  5. E
    Configure an AWS Config rule to monitor the IAM keys and set the EventBridge target to trigger only on AWS Config compliance changes.

Cevap

Recreate the Amazon EventBridge rule in the us-east-1 region and ensure that an active AWS CloudTrail trail is configured to capture global service events.
Because IAM is a global AWS service, all of its API activities are processed and logged in the us-east-1 region. To monitor these activities in real time using Amazon EventBridge, the EventBridge rule must be created in the us-east-1 region. In addition, EventBridge relies on AWS CloudTrail logs to detect AWS API call events; hence, an active CloudTrail trail must be configured to log global service events.

Adım Adım Çözüm

1
Determine the regional scope of the AWS service being monitored.
IAM is a global service whose API endpoints reside in the us-east-1 region.
This determines where the API call events are delivered and processed.
2
Identify the event source for API detection in Amazon EventBridge.
EventBridge uses CloudTrail logs to detect API calls via the 'AWS API Call via CloudTrail' event source.
CloudTrail must be active and logging global events for EventBridge to trigger.
3
Verify target configuration and rule requirements.
EventBridge rules targeting SNS do not require iam:PassRole permissions.
This rules out standard IAM delegation misconfigurations.

Anahtar Kavram

Monitoring global service events with EventBridge and CloudTrail
Bu soruyu puanla

Konular

Security Monitoring, Logging, and Compliance Auditing

Bu konudan daha fazla soru