Access Control and Auditing

Correct Answer: Enable AWS CloudTrail across all accounts and aggregate logs to a central S3 bucket.

AWS CloudTrail enables the auditing of API requests across all accounts. By enabling CloudTrail and aggregating logs to a central S3 bucket, the company can set up proper auditing and monitoring. The other options focus on different logging and monitoring utilities but do not provide the API request auditing required by the scenario.

Correct Answer: Create IAM users for the team members and follow the Amazon RDS security best practices.

Creating IAM users for the team members and following Amazon RDS security best practices ensures proper access control for the RDS database. Other options do not fulfill the requirement of granting access to specific team members or do not exist in the AWS ecosystem.

Correct Answer: Least-privilege IAM permissions for the Lambda execution role: 1) Amazon S3: s3:ListBucket on the logs bucket and s3:GetObject on the logs bucket objects. 2) Amazon QuickSight: quicksight:UpdateDataSet and quicksight:DescribeDataSet on the target dataset, quicksight:CreateIngestion on that dataset to refresh SPICE, and quicksight:PassDataSource on the existing data source used by the dataset.

The Lambda function must read S3 access logs, which requires s3:GetObject on the log objects and typically s3:ListBucket to enumerate new log files. To update what QuickSight uses for analysis without over-privileging, the function needs dataset-level permissions: quicksight:UpdateDataSet and quicksight:DescribeDataSet to modify/inspect the dataset, and quicksight:CreateIngestion to trigger a SPICE refresh so visuals and dashboards update. If the dataset references an existing QuickSight data source, the function also needs quicksight:PassDataSource to authorize using that data source in the dataset operations. Broad permissions such as full S3 access or QuickSight administrator are unnecessary and violate least privilege.