What is the FASTEST way to create a custom 1AM policy for the EC2 instance to meet this requirement?
Create a new IAM policy based on services that the build server deployed or updated in the last 3 months.
Create a new IAM policy that includes all actions that AWS CloudTrail recorded for the IAM role in the last 3 months.
Create a new permissions boundary policy that denies all access. Associate the permissions boundaries with the IAM role.
Create a new IAM policy by using Amazon Athena to query an Amazon S3 bucket that contains AWS CloudTrail events that the IAM role performed in the last 3 months.
Explanations:
Creating a policy based on the services used in the last 3 months may not cover all the necessary permissions or may miss certain actions.
Creating a policy based on the actions AWS CloudTrail recorded for the IAM role in the last 3 months ensures the policy has only the necessary permissions.
Permissions boundaries restrict permissions but don’t help in defining the exact permissions required for the IAM role, which is needed here.
Using Amazon Athena to query CloudTrail logs to generate an IAM policy is inefficient and unnecessarily complex compared to using CloudTrail directly.
I calculate that the answer is:
Create a new IAM policy that includes all actions that AWS CloudTrail recorded for the IAM role in the last 3 months.