How to Immediately Alert on Non-CloudFormation IAM Role Creation?

DVA-C02 By islever Editorial Last updated Aug 27, 2026

Short answer

D Create an Amazon EventBridge rule to filter events from CloudTrail if a role was created without CloudFormation. Specify the SNS topic as the target of the EventBridge rule.

Question

A company needs to deploy all its cloud resources by using AWS CloudFormation templates. A developer must create an Amazon Simple Notification Service (Amazon SNS) automatic notification to help enforce this rule. The developer creates an SNS topic and subscribes the email address of the company's security team to the SNS topic. The security team must receive a notification immediately if an IAM role is created without the use of CloudFormation. Which solution will meet this requirement?

Create an AWS Lambda function to filter events from CloudTrail if a role was created without CloudFormation. Configure the Lambda function to publish to the SNS topic. Create an Amazon EventBridge schedule to invoke the Lambda function every 15 minutes.
Create an AWS Fargate task in Amazon Elastic Container Service (Amazon ECS) to filter events from CloudTrail if a role was created without CloudFormation. Configure the Fargate task to publish to the SNS topic. Create an Amazon EventBridge schedule to run the Fargate task every 15 minutes.
Launch an Amazon EC2 instance that includes a script to filter events from CloudTrail if a role was created without CloudFormation. Configure the script to publish to the SNS topic. Create a cron job to run the script on tile EC2 instance every 15 minutes.
Create an Amazon EventBridge rule to filter events from CloudTrail if a role was created without CloudFormation. Specify the SNS topic as the target of the EventBridge rule. Correct Answer

Key Takeaways

The exam tests your ability to choose event-driven architectures over scheduled polling, with the common trap being the selection of Lambda or container-based solutions that inherently introduce latency.

This question tests implementing real-time AWS compliance monitoring using CloudTrail, EventBridge, and SNS. The community unanimously agrees that a direct EventBridge rule targeting SNS is the only solution that satisfies the immediate notification requirement without introducing polling delays.

Common mistake: Candidates occasionally select options involving Lambda or ECS, mistakenly believing custom compute is needed to process CloudTrail logs, while overlooking EventBridge's native filtering and target routing capabilities.

Expert Analysis

Why the Answer Is Correct

Amazon EventBridge natively integrates with AWS CloudTrail to capture management events like IAM role creation. By configuring an EventBridge rule with a precise event pattern, you can automatically route matching events directly to an SNS topic, ensuring near-instantaneous delivery to subscribed email addresses.

Why the Other Options Are Wrong

Options A, B, and C all rely on scheduled execution intervals (e.g., every 15 minutes). This polling approach fundamentally contradicts the requirement for an immediate notification and introduces unnecessary operational overhead by provisioning Lambda functions, Fargate tasks, or EC2 instances.

Community Comment Notes

Commenters consistently highlight that the word "immediate" eliminates any time-based scheduling mechanism [3]. Users also note that EventBridge rules are specifically designed to match event data and route it to parallel targets without custom code [1]. The unanimous vote distribution confirms this is a straightforward application of managed event-driven services.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

Always scan for timing keywords like 'immediate,' 'real-time,' or 'instant' in exam questions; they explicitly rule out scheduled or polling-based architectures. When asked to monitor AWS API activity, default to CloudTrail paired with EventBridge for serverless, low-latency automation before considering custom compute.

Community Votes

100%

100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 5 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 5

KarBiswa 👍 4 Answered D

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-events-rule.html#:~:text=ENABLED_WITH_ALL_CLOUDTRAIL_MANAGEMENT_EVENTS%3A%20The%20rule,User%20Guide.
ANDRES715 👍 3 Answered D

El desarrollador debe crear una regla de Amazon EventBridge para filtrar eventos de CloudTrail si se crea un rol sin el uso de CloudFormation. Luego, debe especificar el tema de SNS como destino de la regla de EventBridge. Esto permitirá que el equipo de seguridad reciba una notificación inmediata a través del tema de SNS cuando se cree una función de IAM sin el uso de CloudFormation.
NSA_Poker 👍 1 Answered D

(ABC) eliminated. every 15 minutes is not immediate notification. (D) is correct. Amazon EventBridge rule - specifies what EventBridge does with the events delivered to each event bus. A rule specifies which events to send to which targets for processing. A single rule can send an event to multiple targets, which then run in parallel. There are two types of rules: rules that match on event data as events are delivered, and rules that run on a defined schedule. In addition, certain AWS services may create and manage rules in your account as well. Amazon EventBridge rule that match on event data - match against incoming events based on event data criteria,an event pattern. An event pattern defines the event structure and the fields that a rule matches. If an event matches the criteria defined in the event pattern, EventBridge sends it to the target(s) you specify.
Abdullah22 👍 3 Answered D

going with D
65703c1 👍 1 Answered D

D is the correct answer.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Practice All DVA-C02 Questions

Access 100 questions with complete answers and detailed explanations.

View Full DVA-C02 Practice Test →

← Back to DVA-C02 Study Guide