A security team wants a report of IAM roles and users across an AWS Organization that have not used any permissions in the last 90 days. The team wants a managed finding list it can review, without writing or maintaining scripts. Which feature should be used?
Show answer and explanation
Answer: D
IAM Access Analyzer includes unused access analysis, which identifies roles and users with no recent activity and unused permissions within a configured age window. An organization-level analyzer covers member accounts from one place, and the results appear as findings that can be reviewed, archived or resolved. This matches the requirement for a managed report without custom code. The other options either require writing and maintaining queries or only report on a narrower set of credentials.
Why the other options are wrong
- A. AWS Config evaluates resource configuration against rules. A 90-day unused-permissions window is not something a stock rule gives the team, so it would need custom logic to build and maintain.
- B. CloudTrail Lake can answer the question with SQL, but the team would have to write, schedule and maintain the query and export logic. It does not produce a ready-made findings list.
- C. A credential report covers passwords and access keys for IAM users. It does not reflect role session activity or unused permissions, so it cannot show the requested picture.