A city must prove who changed IAM policies last quarter as part of access governance. Which design element supports that accountability without replacing least privilege?
Select an answer to reveal the explanation.
Short Explanation
Least privilege decides what people may do; CloudTrail (and Config) write down what they actually did. You still need tight IAM—logs do not lock the door—but without an audit trail you cannot prove who changed policies last quarter. Turn logging on, not off.
Full Explanation
Proving who changed IAM policies last quarter requires detective controls alongside least privilege: enable AWS CloudTrail to record management API activity (including PutUserPolicy, AttachRolePolicy, and console sign-in events) and use AWS Config where relevant to track configuration history and compliance of IAM resources. Least privilege still decides what people may do; logging decides whether you can demonstrate what they did to auditors and incident responders. Disabling logging to save money trades a small storage cost for an inability to answer governance questions.
Granting everyone AdministratorAccess so changes are easier without review worsens both privilege and audit quality. Replacing IAM with unsigned requests so there is no principal to audit abandons authentication and still would not produce useful accountability.
Exam caveat: use an organization trail to a dedicated logging account with restricted delete and preferably Object Lock or MFA Delete on the log bucket; CloudTrail alone does not prevent bad changes—pair with SCPs and approvals. Config rules can flag IAM users with admin policies continuously. Operational check: make a controlled IAM policy change in a nonprod account; locate the event in CloudTrail including principal ARN, time, and request parameters; confirm logs are immutable to workload admins; produce a sample auditor query for last quarter's IAM policy APIs.