ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

AWS Config records configuration changes for supported resource types, including IAM roles and their attached policies. By enabling AWS Config and turning on recording for IAM resources, every change to AppServerRole is captured and stored, providing a complete audit trail. A managed or custom AWS Config rule can be created to evaluate the role's configuration on every change; when the rule reports non-compliance (for example, the required policy is missing or the role is deleted), AWS Config can publish an Amazon SNS notification that reaches the security team within minutes. CloudTrail also logs the API calls but does not evaluate compliance; administrators would have to write and maintain custom queries or Lambda functions to detect the events. IAM Access Analyzer focuses on identifying unintended external access, not on tracking all role changes. Trusted Advisor's IAM checks run periodically (often daily or weekly) and therefore cannot meet the near-real-time alerting requirement.