A security team manages many AWS accounts under AWS Organizations and wants to identify, across every account, each S3 bucket, IAM role, and KMS key whose resource-based policy grants access to a principal outside their own accounts, without manually inspecting every resource policy by hand. Which service is designed for this?
- Amazon GuardDuty, which uses machine learning to detect anomalous account and network behavior from VPC Flow Logs, DNS query logs, and CloudTrail events
- AWS Config, which records configuration changes for supported resources over time and evaluates them against compliance rules
- IAM Access Analyzer, which defines a zone of trust for an account or organization and uses automated reasoning on resource-based policies to generate a finding whenever a resource is shared with a principal outside that zone
- AWS Trusted Advisor, which checks accounts against a fixed set of cost, performance, and security best-practice checks
Why C? And why not the others?
Correct answer: C. IAM Access Analyzer, which defines a zone of trust for an account or organization and uses automated reasoning on resource-based policies to generate a finding whenever a resource is shared with a principal outside that zone
IAM Access Analyzer is built exactly for this: you enable it for an account or an entire AWS organization, which becomes its zone of trust, and it continuously analyzes resource-based policies on supported resource types (including S3 buckets, IAM role trust policies, and KMS key policies) to generate a finding whenever access is granted to a principal outside that zone, without anyone manually reading each policy. The option describing anomaly detection from flow logs, DNS logs, and CloudTrail events is wrong because that behavioral, log-based threat detection identifies suspicious activity patterns rather than analyzing policy documents for unintended external sharing. The option describing configuration recording and rule evaluation over time is wrong because that service tracks whether a resource's configuration matches a desired state or rule, not specifically whether its resource policy exposes it to outside principals. The option describing a fixed set of periodic best-practice checks is wrong because those checks are generic and scheduled, not a continuous, policy-specific external-access analysis across every resource of the relevant types.
Source: AWS IAM documentation: Identifying unintended resource access with IAM Access Analyzer (https://docs.aws.amazon.com/IAM/latest/UserGuide/what-is-access-analyzer.html)