You are responsible for an application that leverages the Amazon SDK for storing and retrieving data from Amazon S3, accessing multiple DynamoDB tables, and exchanging message with Amazon SQS queues. Your VP of Compliance is concerned that you are not following security best practices for securing all of this access. He has asked you to verify that the application’s AWS access keys are not older than six months and he needs the report periodically. Which of the below options will provide your VP with the requested information?

Answer options:

A.Create a script to query the IAM list-access keys API to get your application access key creation date and create a compliance report for your VP periodically.
B.Provide your VP with a link to IAM AWS documentation to address the VP’s key rotation concerns.
C.Update your application to log changes to its AWS access key credential file and use a periodic Amazon EMR job to create a compliance report for your VP.
D.Create a new set of instructions for your configuration management tool that will periodically create and rotate the application’s existing access keys and provide a compliance report to your VP.

Answer – A
Use the "iam:ListAccessKeys" API to know when the access keys were created. You can use this information to find which keys are older than six months. Run a batch process to generate the compliance report as per the requirement of the VP of the compliance department
Please refer to the below link on the rotation of AWS access keys
https://aws.amazon.com/blogs/security/how-to-rotate-access-keys-for-iam-users/