Get automated email for exposed IAM access keys via an EventBridge rule on AWS Health Risk events

SCS-C02 By islever Editorial Last updated

Detect security threats and anomalies by using AWS services. Evaluate the compliance of AWS resources.

Short answer

C An EventBridge rule on AWS Health Risk events (AWS_RISK_CREDENTIALS_EXPOSED) to SNS alerts on repo-exposed access keys.

Question

A company wants to receive automated email notifications when AWS access keys from developer AWS accounts are detected on code repository sites. Which solution will provide the required email notifications?
  1. Create an Amazon EventBridge rule to send Amazon Simple Notification Service (Amazon SNS) email notifications for Amazon GuardDuty UnauthorizedAccess:IAMUser/lnstanceCredentialExfiltration.OutsideAWS findings.
  2. Change the AWS account contact information for the Operations type to a separate email address. Periodically poll this email address for notifications.
  3. Create an Amazon EventBridge rule that reacts to AWS Health events that have a value of Risk for the service category. Configure email notifications by using Amazon Simple Notification Service (Amazon SNS). Correct Answer
  4. Implement new anomaly detection software. Ingest AWS CloudTrail logs. Configure monitoring for ConsoleLogin events in the AWS Management Console. Configure email notifications from the anomaly detection software.

Key Takeaways

When AWS discovers IAM access keys exposed on public code repositories, it emits an AWS Health event (AWS_RISK_CREDENTIALS_EXPOSED), not a GuardDuty instance-credential finding. Routing AWS Health events through EventBridge to SNS gives automated notification for exactly this exposure scenario. GuardDuty's InstanceCredentialExfiltration finding is specific to EC2 instance-role credentials used externally and does not cover developer access keys found in repos.

The company wants automated email alerts when IAM access keys from developer accounts are found on public code-repository sites. AWS detects credentials exposed in public repositories and publishes an AWS Health event of type AWS_RISK_CREDENTIALS_EXPOSED. An EventBridge rule that matches AWS Health events in the Risk service category (or that specific event type) and targets an SNS topic delivers the required automated email notifications.

Common mistake: Selecting the GuardDuty InstanceCredentialExfiltration option. That finding type applies to EC2 instance-profile temporary credentials used outside AWS, not to IAM user access keys discovered on public code repositories, so it does not match the detection requirement.

Expert Analysis

Why the Answer Is Correct

AWS proactively scans public code repositories and, when it finds exposed IAM access keys, publishes an AWS Health event (AWS_RISK_CREDENTIALS_EXPOSED). An EventBridge rule reacting to AWS Health events in the Risk service category and targeting an SNS topic provides the automated email notification the company needs, directly matching the "access keys detected on code repository sites" scenario.

Why the Other Options Are Wrong

A is wrong because the GuardDuty finding it names, UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration.OutsideAWS, is specific to EC2 instance-role credentials used from outside AWS—not IAM access keys found on public repos—so it does not fire for this case. B (polling account contact email) is manual and not automated. D requires building external anomaly-detection software ingesting CloudTrail, far more operational overhead than the managed AWS Health/EventBridge path.

Community Comment Notes

Community voted A (67) but the precise detection for keys exposed on public repos is the AWS Health AWS_RISK_CREDENTIALS_EXPOSED event, which option C targets. A commenter correctly noted A's finding type is "exclusive to EC2 instance profiles" and that C is the detection path. The technically correct answer is C.

Official Reference

https://docs.aws.amazon.com/health/latest/ug/event-bridge-health.html

This link opens the official vendor documentation in a new tab.

Community Votes

A
67%
C
33%

67% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 7 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 7

  1. AWSLoverLoverLoverLoverLover 👍 1 Answered A
    Correct Answer: A. Create an Amazon EventBridge rule to send Amazon Simple Notification Service (Amazon SNS) email notifications for AWS Health events with the eventTypeCode AWS_RISK_CREDENTIALS_EXPOSED. Not C. Create an Amazon EventBridge rule that reacts to AWS Health events that have a value of Risk for the service category. Configure email notifications by using Amazon Simple Notification Service (Amazon SNS). While this captures a broader range of events, it may lead to unnecessary notifications. Focusing specifically on the AWS_RISK_CREDENTIALS_EXPOSED event ensures that alerts are relevant to exposed credentials.
  2. Wardove 👍 1 Answered C
    The Answer is C, here is a similar solution: https://github.com/aws/aws-health-tools/blob/master/automated-actions/AWS_RISK_CREDENTIALS_EXPOSED/README.md Answer cannot be A because referenced finding type is exclusive to EC2 instance profiles, and is triggered only if instance session credentials are actually being used to authenticate as the instance. https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-iam.html#unauthorizedaccess-iam-instancecredentialexfiltrationoutsideaws
  3. mikelord 👍 1 Answered A
    Option A is the correct solution because it leverages Amazon GuardDuty to detect unauthorized use or exposure of AWS access keys and uses Amazon EventBridge along with Amazon SNS to provide automated email notifications, efficiently meeting the requirement with the least effort.
  4. phmeeeee 👍 1 Answered A
    C - AWS Health focuses on service status & planned changes. Correct answer is A - GuardDuty can detect exposed credentials and generates the finding UnauthorizedAccess and send the event to EventBridge to trigger the SNS.
  5. VPNalumni 👍 1
    https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-iam.html#unauthorizedaccess-iam-instancecredentialexfiltrationoutsideaws A
Show 2 more comments
  1. SCSC02Q 👍 1 Answered C
    Its C, since Q asks for DETECTION, whereas A is only after the event, GuardDuty finding indicates compromised access has already happened.
  2. youonebe 👍 1 Answered A
    answer A, no doubt

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Preserve EC2 forensic evidence by isolating first, then capturing memory before stopping the instance

S-grade

Grant the report Lambda Security Hub read-only access because findings are already in Security Hub

S-grade

Deny inbound MySQL 3306 and allow outbound TLS 443 with ephemeral return in a custom NACL

S-grade

Prepare a PHI/public-bucket audit with Macie, Audit Manager, and Security Hub FSBP

S-grade

← Back to SCS-C02 Study Guide