A government agency is storing highly confidential files in an encrypted Amazon S3 bucket. The agency has configured federated access and has allowed only a particular on-premises Active Directory user group to access this bucket. The agency wants to maintain audit records and automatically detect and revert any accidental changes administrators make to the IAM policies used for providing this restricted federated access. Which of the following options provide the FASTEST way to meet these requirements?
A) Configure an Amazon CloudWatch Events Event Bus on an AWS CloudTrail API for triggering the AWS Lambda function that detects and reverts the change.
B) Configure an AWS Config rule to detect the configuration change and execute an AWS Lambda function to revert the change.
C) Schedule an AWS Lambda function that will scan the IAM policy attached to the federated access role for detecting and reverting any changes.
D) Restrict administrators in the on-premises Active Directory from changing the IAM policies.

Question

Quizplus · Accepted Answer

AWS Config rules can take up to 6 hours to evaluate a configuration change, whereas CloudWatch Events can trigger a Lambda function within minutes.

A Government Agency Is Storing Highly Confidential Files in an Encrypted