ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

CloudTrail already records every IAM API call. When the trail is configured to send events to CloudWatch Logs, metric filters can look for specific calls such as CreatePolicy, PutPolicyVersion, DeletePolicy, and DetachPolicy. A CloudWatch alarm that watches the metric can then use Amazon SNS to deliver immediate notifications. This approach is entirely managed, uses existing AWS services, and requires no Lambda or other custom code.

GuardDuty focuses on threat detection and does not generate findings solely for legitimate IAM policy changes. CloudTrail Insights finds statistical anomalies rather than specific configuration changes, so a normal but unscheduled change may go unnoticed. An EventBridge rule with a Lambda function would work but contradicts the requirement to avoid custom code and usually costs more to run and maintain than a metric filter and alarm.