A city’s IAM administrators want a governance report that helps review account credentials and access-related hygiene across IAM users. Which approach aligns with that AWS governance reporting need?
Select an answer to reveal the explanation.
Short Explanation
Credential reports are like a muster roll for keys and passwords — who has what, whether MFA is on, whether keys are stale. Spreadsheets alone are fragile, and sharing root secrets is the opposite of governance. Use the IAM reporting aids AWS already provides.
Full Explanation
IAM credential reports and related access reporting are governance aids that help city IAM administrators review credential status and access-related hygiene across IAM users — a muster roll for keys and passwords showing who has what, whether MFA is enabled, and whether access keys look stale. Disabling CloudTrail permanently so reports remain "private from auditors" undermines accountability. Relying only on handwritten spreadsheets is fragile when AWS already provides credential reporting aids. Publishing root user passwords to a shared drive is the opposite of governance. Distractors fail by attacking auditability, by rejecting AWS reporting features, or by spreading root secrets. Exam caveat: credential reports inform reviews; administrators must still disable unused credentials, enforce MFA, and remove lingering access keys as follow-up work. Operational check: generate credential reports on a schedule, ticket stale keys and missing MFA for human users, prohibit root access keys, and retain report artifacts for audit evidence alongside CloudTrail reviews of sensitive IAM changes. In practice, schedule credential-report reviews alongside joiner-mover-leaver tickets so stale keys and missing MFA never wait for the annual audit to surface.