How to Alert When an IAM User Creates an Access Key Without MFA
An organization wants to detect and alert on any IAM user that creates a new access key without using multi-factor authentication (MFA). What is the MOST efficient way to achieve this?
Quick Answer
The answer is to create a CloudWatch Events rule that triggers on CreateAccessKey events and checks if the user's MFA status is inactive. This is correct because CloudTrail logs every CreateAccessKey API call, and CloudWatch Events can evaluate the userIdentity details in real time to determine whether MFA was used during the session, allowing you to detect IAM user create access key without MFA efficiently. On the AWS Certified Security Specialty SCS-C02 exam, this scenario tests your understanding of detective controls versus preventive ones—CloudTrail and Events are ideal for monitoring API-level actions, while Config rules are better for static resource compliance. A common trap is choosing IAM Access Analyzer, which analyzes resource policies, not user actions. Memory tip: think “API call = CloudTrail + Events,” not Config or logs.
⚠ Common exam trap
Watch out — candidates often confuse the AWS Config rule for 'IAM user MFA' (which only checks if MFA is enabled on the user account) with the ability to detect MFA usage during a specific API call, leading them to select Option C.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a CloudWatch Events rule that triggers on CreateAccessKey events, and check if the user's MFA status is inactive.
CloudWatch Events (now Amazon EventBridge) can capture the CreateAccessKey API call in real time, and a Lambda target can check the IAM user's MFA status via the GetLoginProfile or ListMFADevices API. This provides immediate detection and alerting without polling or log analysis, making it the most efficient approach for this specific requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a CloudWatch Events rule that triggers on CreateAccessKey events, and check if the user's MFA status is inactive.
Why this is correct
CloudTrail logs the event and CloudWatch Events can evaluate conditions in real time.
- ✗
Analyze S3 server access logs to detect access key creation.
Why it's wrong here
S3 server access logs are for S3 object access, not IAM events.
- ✗
Enable AWS Config managed rule for IAM user MFA, which monitors if users have MFA enabled.
Why it's wrong here
Config rules assess resource configurations, not whether MFA was used during a specific API call.
- ✗
Use IAM Access Analyzer to monitor for unused access keys.
Why it's wrong here
Access Analyzer analyzes policies, not API calls.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
This SCS-C02 question is part of Courseiva's 376-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SCS-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company wants to receive an alert when an IAM user creates a new access key. Which AWS service should be used to trigger the alert?
easy- A.Amazon CloudWatch Logs
- B.Amazon GuardDuty
- ✓ C.AWS CloudTrail and Amazon CloudWatch Events
- D.AWS Config
Why C: AWS CloudTrail captures API calls made by or on behalf of an IAM user, including CreateAccessKey events. These events can be sent to Amazon CloudWatch Events (now part of Amazon EventBridge) using a rule that matches the specific API call, which then triggers an alert (e.g., via SNS or Lambda). This combination enables real-time monitoring and notification for security-sensitive actions like access key creation.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.