Alert on IAM Access Key Creation with CloudTrail and CloudWatch
A company uses AWS CloudTrail to record API calls across multiple accounts and regions. The security team needs to be alerted immediately when an IAM user creates a new access key. Which combination of services should be used to achieve this with minimal latency?
Quick Answer
The answer is to send CloudTrail logs to CloudWatch Logs, create a metric filter, and set up a CloudWatch Alarm to publish to an SNS topic. This combination works because CloudTrail records the `CreateAccessKey` API call as an event, which is streamed to CloudWatch Logs where a metric filter can count occurrences of that specific event name, triggering an alarm with minimal latency. On the AWS Certified DevOps Engineer Professional DOP-C02 exam, this pattern tests your understanding of real-time operational monitoring versus batch or event-driven alternatives; a common trap is choosing Amazon EventBridge (formerly CloudWatch Events) for direct event matching, but the question emphasizes minimal latency and the classic metric filter approach is the most straightforward and low-latency pattern for alerting on IAM access key creation. Remember the memory tip: "Filter, Alarm, Notify" — the metric filter watches the log stream, the alarm triggers on the threshold, and SNS delivers the alert.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Send CloudTrail logs to CloudWatch Logs, create a metric filter, and set up a CloudWatch Alarm to publish to an SNS topic.
CloudTrail can stream logs to CloudWatch Logs, where a metric filter can be configured to match the 'CreateAccessKey' API call. This metric filter triggers a CloudWatch Alarm, which publishes to an SNS topic for immediate notification, providing minimal latency. Option B is incorrect because S3 event notifications on the CloudTrail bucket notify on object creation, but CloudTrail delivers log files in batches (e.g., every 5 minutes), causing delays beyond the required minimal latency. Option C is incorrect because while Amazon EventBridge can match CloudTrail events in near real-time, the question's intended solution (and the one that best fits 'minimal latency') is the metric filter + alarm pattern; however, EventBridge is a valid alternative, but the correct answer as per options is A. Option D is incorrect because polling the CloudTrail API every minute is inefficient, introduces latency, and does not provide real-time alerting.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Send CloudTrail logs to CloudWatch Logs, create a metric filter, and set up a CloudWatch Alarm to publish to an SNS topic.
Why this is correct
This is the standard low-latency alerting pattern for CloudTrail events.
- ✗
Enable S3 event notifications on the CloudTrail S3 bucket to trigger a Lambda function.
Why it's wrong here
S3 event notifications have higher latency and are not ideal for real-time alerting.
- ✗
Use Amazon EventBridge to match the CloudTrail event and invoke an AWS Lambda function that sends an email.
Why it's wrong here
EventBridge is a valid option but not the typical minimal latency pattern described in best practices.
- ✗
Configure a Lambda function to poll the CloudTrail API every minute and check for new access keys.
Why it's wrong here
Polling introduces delay and is inefficient compared to event-driven approaches.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DOP-C02 question from scratch — 251 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on DOP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company uses AWS Organizations with multiple accounts. The security team needs to receive real-time notifications when any IAM user in any account creates an access key. Which solution is the most operationally efficient?
hard- A.Enable CloudTrail in all accounts and send logs to a central S3 bucket, then use Amazon Athena to query.
- B.Create an SCP that denies access key creation and monitor with CloudWatch.
- C.Use AWS Trusted Advisor to check for exposed access keys.
- ✓ D.Use AWS Config rules with a CloudWatch Events rule to detect CreateAccessKey and publish to an SNS topic.
Why D: The most operationally efficient because AWS Config rules can evaluate resource configurations and, when paired with a CloudWatch Events rule, can detect the CreateAccessKey API call in real-time and publish a notification to an SNS topic. Option A is incorrect because while CloudTrail logs are useful for auditing, using Athena to query logs is not real-time and adds operational overhead. Option B is incorrect because SCPs can deny actions but do not provide notifications. Option C is incorrect because Trusted Advisor checks for exposed keys after creation, not in real-time.
Variation 2. A company uses AWS CloudTrail to log API activity. The security team wants to be alerted when an IAM user creates a new access key. Which TWO steps should be taken to accomplish this? (Choose TWO.)
medium- A.Enable CloudTrail Insights to detect unusual activity in the account.
- ✓ B.Configure the CloudWatch Events rule to send a notification to an Amazon SNS topic.
- ✓ C.Create an Amazon CloudWatch Events rule that matches the CreateAccessKey API call via CloudTrail.
- D.Create an AWS Config rule that checks for access key creation and sends an SNS notification.
- E.Use CloudWatch Logs Insights to run a query on the CloudTrail logs and set an alarm.
Why B: Amazon CloudWatch Events (now Events) can be configured to match specific API calls logged by CloudTrail, such as CreateAccessKey. When the rule triggers, it can invoke an SNS topic to send an alert, enabling real-time notification. This approach directly monitors the API activity without additional overhead.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.