Which combination of actions should a SysOps administrator take to meet this requirement?
(Choose two.)
Create an Amazon EventBridge (Amazon CloudWatch Events) rule with AWS CloudTrail as the event source and IAM CreateUser as the specific API call for the event pattern.
Create an Amazon EventBridge (Amazon CloudWatch Events) rule with Amazon CloudSearch as the event source and IAM CreateUser as the specific API call for the event pattern.
Create an Amazon EventBridge (Amazon CloudWatch Events) rule with AWS IAM Access Analyzer as the event source and IAM CreateUser as the specific API call for the event pattern.
Use an Amazon Simple Notification Service (Amazon SNS) topic as an event target with an email subscription.
Use an Amazon Simple Email Service (Amazon SES) notification as an event target with an email subscription.
Explanations:
An EventBridge rule with CloudTrail as the event source can capture IAM CreateUser API calls. This is the correct way to track API activity within AWS accounts.
Amazon CloudSearch is not a valid event source for monitoring AWS API calls. CloudSearch is a search service, not used for capturing CloudTrail events.
AWS IAM Access Analyzer does not generate events for API calls like CreateUser. It is used for analyzing resource access policies, not API activity.
SNS can be used as an event target for EventBridge rules. You can set up an email subscription to receive alerts when the CreateUser API call is triggered.
Amazon SES is not typically used as an event target for EventBridge rules. SNS is the recommended service for sending email notifications.
I sort that the answer is:
Create an Amazon EventBridge (Amazon CloudWatch Events) rule with AWS CloudTrail as the event source and IAM CreateUser as the specific API call for the event pattern.