A project ended but its roles and shares remain.
Revoke unnecessary access and preserve the review decision.
Which governance approach is most appropriate?
Review effective permissions, last use, owner approval, and project expiry across IAM, Lake Formation, S3, and KMS.
Detailed explanation
Unneeded access is revoked with an auditable decision.
Unneeded access is revoked with an auditable decision.
Lifecycle does not manage IAM roles.
Lifecycle does not manage IAM roles.
Planned, emergency, or indirect access could be broken.
Planned, emergency, or indirect access could be broken.
Departed users and ended projects retain access.
Departed users and ended projects retain access.
Check official documentation
Compare the following points with the official documentation.
AWS IAM Access Analyzer、last accessed information、Lake Formation grants、CloudTrailの公式説明を確認する。
What to confirm
未使用だけの自動削除と、所有者承認を伴うアクセスレビューの違いを説明できる。
Key points
- Access review
- Last accessed
- Owner approval
- Revocation
Notes
- Environment: AWS公式DEA-C01試験ガイドと各サービスの公式ドキュメントの確認
- Confirm current AWS service behavior in the official DEA-C01 documentation.
Foundation review
Time-limited access
Give projects and temporary work an expiry that requires reapproval.
Indirect permissions
Review groups, role chains, SCPs, and resource policies, not only direct grants.