Match the CloudTrail event pattern for AssumeRole in EventBridge and notify SNS from a Lambda
A company gives its employees limited rights to AWS. DevOps engineers have the ability to assume an administrator role. For tracking purposes, the security team wants to receive a near-real-time notification when the administrator role is assumed. How should this be accomplished?
Community Votes
100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The signal for a role assumption is the CloudTrail record of the AssumeRole API call, so the EventBridge rule must use a CloudTrail event pattern scoped to that action on the administrator role, which is what option D does (D). Option C uses a Management Console sign-in event pattern, which only fires when a user signs in to the console, so a developer who assumes the role through the CLI or an API would not be detected. Option A polls logs in S3 with Athena on an ad hoc basis, which is not near real time. Option B misapplies GuardDuty, a threat detection service, to identity activity.
Assuming a role is recorded by CloudTrail as an API call, so the way to observe it is a CloudTrail event pattern filtered on the AssumeRole action for the administrator role. An EventBridge rule using that pattern matches the event as it happens, invokes an AWS Lambda function, and the function publishes a message to an Amazon SNS topic, delivering the notification in near real time. This combines managed event routing with a small function for the notification step.
Using an EventBridge rule with a Management Console sign-in event pattern (C) — console sign-in events only cover authentication through the browser console, so role assumptions made through the CLI, an SDK, or an API would never trigger the rule, which is precisely the tracking the security team needs. Publishing CloudTrail logs to S3 and querying them later with Athena to send a notification (A) — ericphl identified that this is not a near-real-time solution because Athena queries are run on demand against stored logs rather than reacting to events as they occur. Using GuardDuty to monitor role assumptions (B) — ericphl noted GuardDuty is designed for threat detection, not for monitoring role assumption activity.
Community Discussion (4 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The security team wants near-real-time notification when the administrator role is assumed. Assuming a role is an API operation, and AWS CloudTrail records it as an event, so the correct trigger is a CloudTrail event pattern filtered for that AssumeRole action on the administrator role. An Amazon EventBridge rule built on that pattern matches the event as it occurs and invokes an AWS Lambda function, which publishes a message to an Amazon SNS topic that the security team is subscribed to. Because the whole chain is event-driven, the notification arrives in near real time rather than depending on a periodic query, which satisfies the requirement (D). D is the correct answer.Why the Other Options Are Wrong
C creates an EventBridge rule using a Management Console sign-in event pattern that publishes to SNS. Console sign-in events are emitted only when a user authenticates through the AWS Management Console, so a developer who assumes the administrator role through the AWS CLI, an SDK, or a direct API call would not produce a matching event and would go unnoticed. teo2157 raised this objection, and ericphl noted the same limitation. B configures Amazon GuardDuty to monitor when the administrator role is assumed. As ericphl pointed out, GuardDuty is a threat detection service that looks for malicious or anomalous activity; it does not report ordinary identity events such as role assumptions, so it cannot serve as this audit signal. A configures AWS Config to publish logs to Amazon S3 and uses Athena to query the logs to send a notification. This is not a near-real-time mechanism, as ericphl identified: Athena queries are executed against historical log data on demand, so there is no automatic trigger when a role is assumed and the delay depends on when someone chooses to run a query. D is correct.Community Comment Notes
Community voted D unanimously. ericphl gave three separate reasons, that A is not a near-real-time solution, that B misuses GuardDuty which is for threat detection rather than role monitoring, and that C only monitors console sign-in events. jamesf described the four-service chain of CloudTrail, EventBridge, Lambda, and SNS as a robust approach to tracking role assumption. teo2157 selected D while questioning why a Lambda is needed when EventBridge can publish to SNS directly, which is a fair observation about efficiency but does not change that D is the only option matching the correct CloudTrail-based event pattern. No alternative received support.Official Reference
Related Analysis
Practice All DOP-C02 Questions
Access 85 questions with complete answers and detailed explanations.
View Full DOP-C02 Practice Test →