A Company Uses an External Identity Provider to Allow Federation

question 292

Multiple Choice

A company uses an external identity provider to allow federation into different AWS accounts. A security engineer for the company needs to identify the federated user that terminated a production Amazon EC2 instance a week ago. What is the FASTEST way for the security engineer to identify the federated user?

• A) Review the AWS CloudTrail event history logs in an Amazon S3 bucket and look for the TerminateInstances event to identify the federated user from the role session name.
• B) Filter the AWS CloudTrail event history for the TerminateInstances event and identify the assumed IAM role. Review the AssumeRoleWithSAML event call in CloudTrail to identify the corresponding username.
• C) Search the AWS CloudTrail logs for the TerminateInstances event and note the event time. Review the IAM Access Advisor tab for all federated roles. The last accessed time should match the time when the instance was terminated.
• D) Use Amazon Athena to run a SQL query on the AWS CloudTrail logs stored in an Amazon S3 bucket and filter on the TerminateInstances event. Identify the corresponding role and run another query to filter the AssumeRoleWithWebIdentity event for the user name.

---

Definitions:

Irreversibility

Lack of recognition that actions can be reversed.

Egocentrism

In developmental psychology, a characteristic of children's thinking during the preoperational stage, where they are unable to see situations from perspectives other than their own.

Centration

Focusing on one dimension of a situation while ignoring others.

Conservation

A principle in cognitive development referring to the understanding that quantity or mass remains the same regardless of changes in shape or arrangement.