How can the Administrator identify who is creating the Elastic IP address?
Attach a cost-allocation tag to each requested Elastic IP address with the IAM user name of the Developer who creates it.
Query AWS CloudTrail logs by using Amazon Athena to search for Elastic IP address events.
Create a CloudWatch alarm on the EIPCreated metric and send an Amazon SNS notification when the alarm triggers.
Use Amazon Inspector to get a report of all Elastic IP addresses created in the last 30 days.
Explanations:
Cost-allocation tags cannot be dynamically applied to existing Elastic IPs, and this option won’t help identify who created them directly.
AWS CloudTrail logs can capture detailed API activity, including Elastic IP creation events. Using Amazon Athena to query these logs can help identify the IAM user responsible.
CloudWatch alarms can track specific metrics, but there is no built-in EIPCreated metric for triggering alarms. This option won’t effectively identify the creator.
Amazon Inspector does not track Elastic IP creation events. It’s a security assessment service, not for resource creation tracking.
I map out that the answer is:
Query AWS CloudTrail logs by using Amazon Athena to search for Elastic IP address events.