ExamFinch.com My Study

Study guide

10.2 Auditing Access with CloudTrail Lake & IAM Access Analyzer

Practice this exam

AWS Certified CloudOps Engineer – Associate SOA-C03

Track your progress as you read

Finished sections get a check mark.

1 Chapter 1: Monitoring & Observability Infrastructure

1.1 Configuring Workload Observability 1.2 CloudWatch Agent Architecture & Deployment 1.3 Metric Alarms, Anomaly Detection & Composite Alarms

2 Chapter 2: Alarms, Dashboards & Event-Driven Remediation

2.1 CloudWatch Dashboards & Multi-Account Visibility 2.2 Notification Architecture & Alarm Invocation 2.3 Amazon EventBridge Rules, Event Buses & Troubleshooting 2.4 Automated Remediation with Systems Manager & Lambda

3 Chapter 3: Performance Optimization for Compute, Storage & Databases

3.1 EC2 & Compute Performance Optimization 3.2 Amazon EBS Performance Metrics & Volume Tuning 3.3 S3 Performance Strategies & Data Transfer 3.4 Shared Storage (EFS/FSx) & Database Performance

4 Chapter 4: Compute & Database Scalability and Elasticity

4.1 EC2 Auto Scaling Policies & Elasticity 4.2 Auto Scaling Advanced Operations: Warm Pools & Lifecycle Hooks 4.3 Dynamic Scalability Through Caching 4.4 Managed Database Scaling: RDS, Aurora & DynamoDB

5 Chapter 5: High Availability, Fault Tolerance & Load Balancing

5.1 Elastic Load Balancing (ALB/NLB) Configuration & Troubleshooting 5.2 Route 53 Health Checks & DNS Failover 5.3 Multi-AZ Architecture & Fault-Tolerant Deployments

6 Chapter 6: Backup, Data Protection & Disaster Recovery

6.1 Centralized Backup Automation & AWS Backup 6.2 Database Restore Strategies & RTO/RPO Management 6.3 Storage Versioning, Replication & Immutability 6.4 Disaster Recovery Patterns & Multi-Region Resilience

7 Chapter 7: Infrastructure as Code with CloudFormation & AWS CDK

7.1 CloudFormation Foundations & Resource Modeling 7.2 Managing Stacks, Drift Detection & Change Sets 7.3 Infrastructure as Code with AWS CDK 7.4 Identifying & Remediating Deployment Failures

8 Chapter 8: Multi-Account Provisioning, Containers & Third-Party IaC

8.1 Golden Images with EC2 Image Builder & Amazon ECR 8.2 Multi-Account & Multi-Region Resource Sharing 8.3 Deployment Strategies & Container Deployments 8.4 Third-Party Automation with Terraform & Git Workflows

9 Chapter 9: Systems Manager & Event-Driven Operations Automation

9.1 AWS Systems Manager Core Management & Run Command 9.2 Systems Manager Patch Manager & Session Manager 9.3 Event-Driven Operations Automation

10 Chapter 10: Identity, Access Management & Governance

10.1 Advanced IAM Policies, Roles & Policy Conditions 10.2 Auditing Access with CloudTrail Lake & IAM Access Analyzer 10.3 Multi-Account Security: Organizations, SCPs & Identity Center 10.4 Compliance Enforcement with AWS Config & Conformance Packs

11 Chapter 11: Data Security, Encryption & Vulnerability Management

11.1 Data Classification & Amazon S3 Security 11.2 Encryption at Rest with AWS Key Management Service (KMS) 11.3 Encryption in Transit with AWS Certificate Manager (ACM) 11.4 Secrets Management & Centralized Security Findings

12 Chapter 12: VPC Architecture, Endpoints & Network Protection

12.1 VPC Core Architecture, Subnetting & High Availability NAT 12.2 Private Network Connectivity: VPC Endpoints & Peering 12.3 Network Protection & Edge Security Auditing

13 Chapter 13: DNS, Route 53 Routing & Content Delivery

13.1 DNS Architecture & Route 53 Resolver for Hybrid Clouds 13.2 Route 53 Advanced Routing Policies & Query Logging 13.3 Global Content & Service Distribution: CloudFront & Global Accelerator

14 Chapter 14: Network Troubleshooting, Traffic Analysis & Hybrid Connectivity

14.1 VPC Configuration Troubleshooting & Analysis Tools 14.2 Network Traffic Analysis: VPC Flow Logs & Log Analytics 14.3 CloudFront Caching & Hybrid Connectivity Troubleshooting

10.2 Auditing Access with CloudTrail Lake & IAM Access Analyzer

Key Takeaways Explain This Topic AI

AWS CloudTrail multi-Region trails provide an immutable, cryptographically validated audit log of all AWS API activity, using SHA-256 digest files to detect log file tampering.

CloudTrail Lake is a fully managed audit data lake that enables operators to query up to 10 years of CloudTrail activity using standard ANSI SQL without managing Athena tables, Glue crawlers, or S3 ETL pipelines.

CloudTrail Lake accelerates security investigations by querying unauthorized API calls (such as Client.UnauthorizedOperation and AccessDenied) and identifying anomalous credential usage across regions.

IAM Access Analyzer provides two distinct capabilities: External Access Analyzer, which detects resources shared outside an AWS account or Organization zone of trust, and Unused Access Analyzer, which flags unused roles, access keys, and permissions.

The IAM Credential Report delivers an account-wide audit of user passwords, access key ages, and MFA devices, while IAM Policy Simulator validates effective permissions prior to deploying policy changes.

Last updated: September 2026

10.2 Auditing Access with CloudTrail Lake & IAM Access Analyzer

CloudOps Blueprint Focus: The AWS Certified CloudOps Engineer – Associate (SOA-C03) exam tests your ability to audit API activity and identity security, query audit telemetry across multi-account environments using CloudTrail Lake SQL queries, discover unintended public and cross-account resource exposure with IAM Access Analyzer, enforce least privilege with Unused Access Analyzer, and evaluate credential health using Credential Reports and Policy Simulator.

CloudTrail Multi-Region Trails, Encryption & Digest File Integrity

AWS CloudTrail records all AWS API invocations as structured JSON event logs, providing the foundation for security auditing and operational governance.

Multi-Region Trails & Centralized Aggregation

Enterprise standards mandate deploying an organization-wide multi-Region trail from the AWS Organizations management account:

Comprehensive Regional Logging: Automatically captures management events across all active AWS Regions and newly enabled Regions.

Global Services: Logs non-regional services (IAM, STS, Route 53, CloudFront) to a designated home region.

Centralized Log Archive: Delivers .json.gz log files to an isolated S3 bucket in a dedicated Log Archive account.

Encryption & Log File Integrity Validation

Audit trails must be protected against tampering and unauthorized deletion:

KMS Customer Managed Key (CMK): Encrypts logs using SSE-KMS, restricting decryption permissions strictly to security audit roles.

S3 Object Lock: Enforces Compliance Mode (WORM—Write Once, Read Many) to prevent log modification or premature deletion by any account entity.

Digest File Validation: Every hour, CloudTrail writes a digest file ( digest.json.gz ) containing SHA-256 cryptographic hashes of delivered logs, the previous digest hash, and a digital signature signed by the AWS private key. Operators run aws cloudtrail validate-logs to mathematically prove logs were not altered, deleted, or injected post-delivery.

CloudTrail Lake: Managed SQL Audit Data Lake

Traditional log analysis required maintaining fragile pipelines: streaming S3 objects, defining AWS Glue crawlers, partitioning by year/month/day, and configuring Amazon Athena tables. AWS CloudTrail Lake replaces this overhead with a fully managed, serverless audit data lake.

Event Data Stores (EDS) & Retention

An Event Data Store (EDS) aggregates audit events across an AWS Organization:

Ingests management events, S3/Lambda data events, and external partner events (via PutAuditEvents ).

Supports immutable retention periods from 7 days up to 10 years (3,653 days) , satisfying strict regulatory mandates (SEC Rule 17a-4, HIPAA, SOC 2).

Eliminates ETL pipelines, Glue catalog schemas, and Athena workgroup management.

Forensic Investigations with ANSI SQL

CloudTrail Lake allows operators to run standard ANSI SQL queries directly against years of audit telemetry to identify security incidents and operational errors.

Querying Unauthorized Operations and Denied Access

To identify brute-force enumeration or misconfigured automation, CloudOps engineers query for unauthorized error codes: SELECT

  • eventTime,
  • eventName,
  • userIdentity.arn AS principal_arn,
  • sourceIPAddress,
  • errorCode,
  • errorMessage
  • FROM
  • eds-3910ab38-9a2c-4720-bd81-fbc382901a8d
  • WHERE
  • eventTime > '2026-09-01 00:00:00'
  • AND errorCode IN ('AccessDenied', 'Client.UnauthorizedOperation')
  • ORDER BY
  • eventTime DESC
  • LIMIT 100;
  • Detecting Anomalous Regional Spikes

Adversaries with compromised credentials often launch unauthorized GPU or mining instances in remote regions. SQL queries aggregate activity outside approved operating boundaries: SELECT

  • awsRegion,
  • eventName,
  • userIdentity.principalId,
  • COUNT(*) AS call_count
  • FROM
  • eds-3910ab38-9a2c-4720-bd81-fbc382901a8d
  • WHERE
  • awsRegion NOT IN ('us-east-1', 'us-west-2')
  • GROUP BY
  • awsRegion, eventName, userIdentity.principalId
  • ORDER BY
  • call_count DESC;
  • IAM Access Analyzer: External vs. Unused Access Analysis

AWS IAM Access Analyzer uses automated reasoning (mathematical logic theorem proving) to evaluate permissions across two critical operational domains:

1. External Access Analyzer (Resource Exposure Monitoring)

Evaluates resource-based policies to identify resources accessible to principals outside a defined Zone of Trust (an AWS account or entire AWS Organization).

Supported Resources: Amazon S3 buckets, IAM role trust policies, AWS KMS keys, Amazon SQS queues, AWS Secrets Manager secrets, AWS Lambda functions, and Amazon ECR repositories.

Findings: Highlight the external principal, actions permitted, and existing condition constraints, enabling teams to remediate unintended public or cross-account exposures before incidents occur.

2. Unused Access Analyzer (Enforcing Least Privilege)

Continuously reviews IAM identities to locate stale permissions and inactive credentials:

Unused Roles: Roles not assumed within a defined window (e.g., 90 days).

Unused Access Keys: Active keys with no signed API requests in >90 days.

Unused Passwords: Console users who have not logged in within the tracking period.

Unused Actions: Identifies specific permissions in policies that were never exercised.

Automated Policy Generation: Access Analyzer can inspect an identity's CloudTrail event history over the prior 90 days and automatically generate a fine-grained, least-privilege IAM policy.

IAM Policy Simulator & IAM Credential Report

CloudOps engineers use two specialized tools to validate permissions and audit credential hygiene:

IAM Policy Simulator

Tests and troubleshoots effective permissions for IAM users, groups, and roles before deploying policy changes to production.

Simulates interactions between identity policies, resource policies, permissions boundaries, and AWS Organizations Service Control Policies (SCPs).

Validates context variables (e.g., verifying access succeeds with corporate aws:SourceIp or fails when aws:MultiFactorAuthPresent is false).

Non-destructive execution tests policies without making actual AWS API calls.

IAM Credential Report

A downloadable, account-wide CSV audit artifact that summarizes the state of all credentials across every IAM user:

Report Field Operational Focus & Compliance Threshold

user The IAM username under audit.

password_enabled / password_last_used Identifies active passwords and dormant user accounts.

password_next_rotation Enforces compliance with corporate password expiration policies.

mfa_active Verifies multi-factor authentication is enabled for console users.

access_key_1_active / last_rotated Flags access keys older than the 90-day rotation benchmark.

access_key_1_last_used_service Identifies orphaned access keys attached to inactive services.

Generated via aws iam generate-credential-report and retrieved with aws iam get-credential-report , this report is essential for compliance audits (SOC 2, ISO 27001) and automated credential pruning.