You need to maintain an AWS Organization. The Organization includes several organization units (OUs) and dozens of accounts. You want to get the service last access data for different OUs and accounts. Then you can refine the policies in the Organization and allow access to only the services that the entities in the AWS Organization use. Which method would you take to address this requirement?

Answer options:

A.Use the AWS Organization root account to login to AWS Console and view the service last access data in AWS Organizations. Click each entity such as OU or account to download the access data report.
B.Use AWS CLI aws iam generate-service-last-accessed-details to get the access report for an IAM resource (user, group, role or policy).
C.Use AWS Console or CLI to view the service access report in IAM for Organization activities. Check the report to see when an allowed service was accessed last time.
D.In AWS Resource Access Manager, download the service access report for any given OU, account or the whole AWS Organization.

Correct Answer – C
Users can view service last access data for AWS Organizations through IAM console, AWS CLI or API. Please check https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_access-advisor-view-data-orgs.html for details.
Option A is incorrect: Because the service last access data should be seen in IAM -> Access reports -> Organization activity. The report cannot be found in AWS Organizations.
Option B is incorrect: Because the correct AWS CLI commands for Organizations should be aws iam generate-organizations-access-report and aws iam get-organizations-access-report.
Option C is CORRECT: Users can get the access report in IAM for an Organization:
Option D is incorrect: Because Resource Access Manager is used to share AWS resources with other AWS accounts. It does not provide service access data.