A security team wants a managed analyzer that flags S3 buckets or IAM roles that grant access to principals outside the organization's account or organization boundary. Which service provides this?
Show answer and explanation
Answer: B
IAM Access Analyzer evaluates resource-based policies and access control lists to find resources, including S3 buckets, that are shared with external entities, and it can also check policies before deployment. Macie inspects object contents for sensitive data, Config records configuration changes, and CloudTrail logs API activity. Each of those tools answers a different question.
Why the other options are wrong
- A. Macie finds sensitive data inside S3 objects, such as personal identifiers, and does not assess who outside the account can reach a bucket.
- C. Config tracks configuration changes and evaluates compliance rules, but it does not analyze external sharing paths by itself.
- D. CloudTrail records API activity for investigation, which helps explain changes after they happen, but it does not identify external access.