IAM Access Analyzer reports unused administrative roles in a parks department account that still trust a broad set of principals. What should the security architects do to improve least privilege?
Select an answer to reveal the explanation.
Short Explanation
Unused admin roles are spare master keys left in the parks shed—harmless until someone finds them. Access Analyzer is the inventory clipboard; delete or shrink what nobody needs. Least privilege is a continuous cleanup, not a one-time workshop slide.
Full Explanation
IAM Access Analyzer findings of unused administrative roles in a parks department account that still trust a broad set of principals are least-privilege defects waiting to be assumed. Security architects should review those findings, remove or tightly scope unused admin roles, and retain only roles with documented need and least-privilege policies. That response works because dormant broad roles remain assumable attack paths until deleted or constrained—unused does not mean harmless. Ignoring unused roles because dormant identities supposedly cannot be assumed without a console password fails conceptually: roles are assumed via STS with trust policy principals, not console passwords. Converting every unused role into an inline AdministratorAccess policy on all EC2 instance profiles fails by spreading excess privilege further. Sharing unused admin roles to every OU via AWS RAM fails as amplifying a bad identity pattern across the organization. Exam caveat: validate break-glass and automation dependencies before deletion; some “unused” roles may be rare DR paths—confirm with CloudTrail before remove, then delete or narrow. Operational check: export Access Analyzer unused findings for the parks account, map last-used timestamps via CloudTrail, delete or rewrite trust/policies for confirmed unused admin roles, and re-scan until high-risk unused admins are gone.