Several teams share one AWS account, and there is a large number of IAM roles. You need a method to periodically check each IAM role and identify unused roles based on a time window that you define. Then you can determine if some roles are obsolete and can be safely removed. Which option is the most appropriate?

Answer options:

A.Periodically trigger a CloudWatch Event rule. Register a Lambda function to evaluate all the IAM roles.
B.Enable AWS Config and check the IAM usage of each IAM role in AWS Config resources.
C.Periodically trigger an AWS Config rule that invokes a Lambda function. The Lambda function checks the status of each IAM role.
D.Setup Amazon Athena to evaluate the usage of IAM roles from the AWS CloudTrail logs.

Correct Answer – C
Option A is incorrect: This option cannot provide you a view of which IAM roles are compliant or not. Option C is better.
Option B is incorrect: AWS Config resources do not provide the usage status of IAM roles. Instead, you should set up an AWS Config rule.
Option C is CORRECT: Because the Lambda function can check each IAM role, and you can view the compliance status in AWS Config.
Option D is incorrect: Because this is not a straightforward solution if compared with option
C. It also cannot provide you a clear view of the compliance status.
Reference:
https://aws.amazon.com/blogs/security/continuously-monitor-unused-iam-roles-aws-config/