Which AWS tool audits password and access key rotation?

Identify AWS access management capabilities. Understand AWS Cloud security, governance, and compliance concepts.
Answer Correct answer: C — Generate the IAM credential report, a CSV listing each user's password last-changed date plus access key creation and last-used dates for audit.

A company has an AWS account. The company wants to audit its password and access key rotation details for compliance purposes. Which AWS service or tool will meet this requirement?

  1. IAM Access Analyzer
  2. AWS Artifact
  3. IAM credential report Correct Answer
  4. AWS Audit Manager

Community Insight

The exam tests whether you can map a reporting/auditing need to the exact IAM feature that exposes credential age data; the trap is confusing AWS Artifact (compliance documents) or IAM Access Analyzer (permission analysis) with credential lifecycle reporting.

The IAM credential report is the AWS tool that produces an auditable, downloadable CSV of every IAM user's password age, password last-used date, access key creation date and key last-used date. This page confirms why the IAM credential report — not IAM Access Analyzer, AWS Artifact or AWS Audit Manager — satisfies the compliance audit requirement.

Choosing AWS Artifact because the word "audit" appears in the question and Artifact is described as a self-service audit artifact portal — but Artifact delivers AWS's own SOC/PCI/ISO reports, not your IAM users' password and access key rotation data.

Community Discussion (16 comments)

Dimagi 👍 2 Selected: C
The IAM credential report provides a downloadable report about the credentials of users in an AWS account. It helps the company audit password and access key rotation details for compliance purposes. The report includes information such as: Password usage and last changed date. Password last used and whether a password is enabled. Access key creation dates and last used dates. Whether access keys are active. Access key rotation information, including when keys were last rotated.
3veryday 👍 1 Selected: C
IAM Credential Report : Audit, CSV download-> see audit
Julio19vp 👍 2 Selected: C
La C es correcta
Kostiantyn12 👍 2 Selected: C
answer is C.
Esther24 👍 1 Selected: B
IAM gère les utilisateurs et les clés, mais AWS Artifact fournit les rapports officiels nécessaires pour prouver la conformité et répondre à un audit. C’est donc le bon outil. - Donc, la bonne réponse est B
Sir_Kay 👍 1 Selected: C
he IAM credential report is an AWS tool that provides detailed information about the status of IAM users' passwords and access keys, including when they were last rotated, whether they are active, and if they are using multi-factor authentication (MFA). This report is ideal for auditing password and access key rotation, which aligns with the company's compliance requirements
Dipa_2910 👍 1 Selected: C
The answer is IAM Credential report - The IAM credenatial report is used for auditing and compliance efforts .The report is used to audit the effects of credential lifecycle management such as passwords and access key update s.
GPFT 👍 1 Selected: C
c is correct
Dmag 👍 1 Selected: C
Credentials Report carries Audit related details related to Password Rotation, Access Keys, MFA etc.
Ruffyit 👍 1
The Correct answer is C. You can use credential reports to assist in your auditing and compliance efforts. You can use the report to audit the effects of credential lifecycle requirements, such as password and access key updates. https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_getting-report.html
Pyrus 👍 19
The Correct answer is C. IAM Access Analyzer: Analyzes IAM policies to identify potential issues and excessive permissions, but doesn't specifically focus on password and access key rotation details. AWS Artifact: Primarily used for managing and tracking infrastructure as code (IaC) configurations, not directly related to credential auditing. IAM credential report: This built-in IAM feature provides detailed information about the rotation history of user passwords and access keys within the account. It shows dates of last password and access key rotation, along with usernames and key IDs. This aligns perfectly with the requirement of auditing password and access key rotation details for compliance purposes. AWS Audit Manager: Offers a comprehensive platform for managing and automating audits across various AWS services, but it requires additional setup and configuration compared to the readily available IAM credential report
khaledsmq 👍 9
AWS Artifact, available in the console, is a self-service audit artifact retrieval portal that provides our customers with on-demand access to AWS’ compliance documentation and AWS agreements. You can use AWS Artifact Reports to download AWS security and compliance documents, such as AWS ISO certifications, Payment Card Industry (PCI), and System and Organization Control (SOC) reports. You can use AWS Artifact Agreements to review, accept, and track the status of AWS agreements such as the Business Associate Addendum (BAA).
TheFivePips 👍 3 Selected: C
C. IAM credential report: The IAM (Identity and Access Management) credential report is a detailed report that lists all users in an AWS account and the status of their various credentials, including password and access key rotation details. It provides information necessary for auditing password and access key rotation activities for compliance purposes. IAM credential report, is the AWS service or tool that will meet the company's requirement to audit password and access key rotation details. The other options are described as follows: A. IAM Access Analyzer: Analyzes resource policies in your AWS environment to help you identify and address unintended access. B. AWS Artifact: Provides on-demand access to AWS compliance reports and documents. D. AWS Audit Manager: Helps you continuously audit your AWS usage to simplify how you assess risk and compliance with regulations and industry standards. While these services may be useful for compliance purposes, they do not specifically address the requirement for auditing password and access key rotation details.
lunamuller 👍 2 Selected: C
Answer C is Correct. Key: "audit its password and access key rotation details for compliance purposes"
Anyio 👍 7 Selected: C
The Correct answer is C. You can use credential reports to assist in your auditing and compliance efforts. You can use the report to audit the effects of credential lifecycle requirements, such as password and access key updates. https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_getting-report.html
inkedia3 👍 2 Selected: C
https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_getting-report.html

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Expert Analysis

Why the Answer Is Correct

The requirement is narrow: audit password and access key rotation details for IAM users. The IAM credential report is the only option that directly answers this, generating a downloadable CSV that lists every IAM user plus password enabled status, password last-changed date, password last-used date, access key creation dates and access key last-used dates. Because it reports credential age, it is the standard mechanism for proving credential lifecycle compliance (for example, keys rotated within 90 days). It is a built-in IAM capability, so no extra service, agent or configuration is needed. As lunamuller summarised, the key phrase in the stem is exactly "audit its password and access key rotation details for compliance purposes".

Why the Other Options Are Wrong

IAM Access Analyzer analyzes resource policies and role trust policies to surface external and unused access — it validates permissions, not credential age, so it cannot report password rotation dates. AWS Artifact is a self-service portal for downloading AWS's own compliance artifacts such as SOC, PCI and ISO reports and agreements; one commenter described it as tracking IaC configurations, which is simply not what Artifact does, and in any case it never lists your users' credentials. AWS Audit Manager automates evidence collection against compliance frameworks, but it is an assessment orchestration tool that draws on data sources like the credential report — it is not the mechanism that produces the password and access key rotation details itself. The credential report is therefore the only directly responsive option.

Community Comment Notes

Consensus among learners is strongly for C — Pyrus states "The Correct answer is C" and walks through why Access Analyzer and Artifact miss the mark, while Anyio quotes the AWS documentation line that you can use credential reports "to assist in your auditing and compliance efforts". 3veryday captures the practical mechanics succinctly with "Audit, CSV download", and Dimagi lists the exact fields returned (password last changed, access key creation and last used dates). The one dissenting view, khaledsmq quoting the Artifact description, correctly describes Artifact's purpose but does not connect it to per-user credential data, so it does not compete with C.

Exam Strategy

When a stem mentions auditing credentials of your own IAM users — password age, key age, key last used, MFA status — answer IAM credential report. Reserve AWS Artifact for questions about obtaining AWS's compliance certifications and agreements, and Audit Manager for building framework-based assessment evidence.

Official Reference

https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_getting-report.html

Exam Strategy

Scan for the words "credential", "password", "access key" and "rotation" together: that trio always points at the IAM credential report. If the stem asks for AWS's compliance certificates (SOC, PCI, ISO), that is AWS Artifact instead — keep the two separate in your mind.

Frequently Asked Questions

Why isn't AWS Artifact the answer for auditing password rotation?

AWS Artifact only delivers AWS's own compliance documents and agreements (SOC, PCI, ISO). It never lists your IAM users' password or access key dates — the IAM credential report does.

Does AWS Audit Manager produce the password and access key rotation data?

No. Audit Manager orchestrates evidence collection against frameworks and can ingest credential-report data, but the underlying rotation details come from the IAM credential report.

More CLF-C02 FAQ →

Related Analysis

Which AWS service provides users with AWS issued reports, ce

A-Grade

A company wants to use the AWS Cloud to deploy an applicatio

A-Grade

A company wants to receive a notification when a specific AW

A-Grade

Practice All CLF-C02 Questions

Access 120 questions with complete answers and detailed explanations.

View Full CLF-C02 Practice Test →

← Back to CLF-C02 Study Guide