You are a DevOps engineer and you need to clean up IAM entities that are no longer used. There is an IAM policy called IAMAccessForDemo which contains CloudFormation full access, KMS full access and some other permissions. However, nobody in your team knows what the IAM policy is used for and whether it is safe to delete it. How would you check the time when the granted services by the policy were last accessed?

Answer options:

A.In AWS Console, click the IAM policy and go to the Policy usage tab. Check if the policy is assigned to any entity. If yes, do not delete the policy.
B.In the AWS CloudTrail console, search the IAM policy to see if the policy has been accessed recently.
C.Look at the IAM Policy configuration timeline in AWS Config to see if the permissions allowed by the policy have been accessed recently.
D.In AWS Console, check the Access Advisor of the IAM policy to see when the permitted services were last accessed. If they were accessed a long time ago, it would be safe to delete the policy.

Correct Answer – D
The Service Last Accessed Data can be found in IAM Access Advisor. Check https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_access-advisor-example-scenarios.html for the example scenarios.
Option A is incorrect: The Policy usage can show whether the policy is used by other IAM entities such as IAM users. However, it does not show the last accessed data.
Option B is incorrect: CloudTrail does not show when the services permitted by the policy were last accessed. Besides, you can only view the last 90 days of events in CloudTrail.
Option C is incorrect: Because the configuration timeline in AWS Config does not show the last accessed data.
Option D is CORRECT: IAM Access Advisor contains the required information. Take the below screenshot as an example: