In a large corporation, an AWS organization is established with several OUs (organizational units). Because of several new security requirements, the security operator needs to create several CloudWatch Events rules. For one rule, the requirement is that if certain AWS services have not been used by an OU for 6 months but are suddenly used recently, an SNS notification will be triggered. How would you quickly get the service-last-accessed information to identify the potential services to add to the CloudWatch Event rule?

Answer options:

A.In the AWS Organization console, click each OU and view the service-last-accessed information. 
B.Send an AWS CLI command to the AWS Config service to get the service-last-accessed information for each organizational unit.
C.In the AWS Resource Groups service, add a resource group for the candidate AWS services. View the last-accessed information for the group.
D.In the IAM access advisor, view the service-last-accessed information for each OU to help identify which services should be added in the CloudWatch Event rule.

Correct Answer – D
The service-last-accessed information can be viewed in the IAM access advisor. Check the introduction in
https://aws.amazon.com/blogs/security/set-permission-guardrails-using-iam-access-advisor-analyze-service-last-accessed-information-aws-organization/.
Option A is incorrect: Because there is no such information in the AWS Organization console.
Option B is incorrect: Because the AWS Config service does not provide such information. Instead, the user can use AWS CLI to call the IAM access advisor endpoint to get the data.
Option C is incorrect AWS Resource Groups can query and group resources. However, it does not provide the data required in this case.
Option D is CORRECT: Because the service-last-accessed information for each OU can be found in the IAM access advisor. Take the below snapshot as an example: