Security wants continuous detection of resources (S3 buckets, KMS keys, IAM roles) shared with principals outside the account. Which tool provides this?
A.IAM credential report
Credential report = user inventory, not resource sharing analysis.
B.IAM Access Analyzer external-access findings
Correct. Policy analysis built for external-access detection.
C.AWS Config conformance packs
Conformance packs check configs, not policy reachability.
D.GuardDuty
GuardDuty detects threats, not shared-resource exposure.
Why this answer
Access Analyzer continuously evaluates resource-based policies and reports findings when a resource is accessible to external principals — the dedicated tool for unintended external sharing. Credential reports list IAM users/keys; Config checks configuration rules; neither analyzes policy reachability for external access.
Correct answer: B · Last reviewed 2026-11-02
Official AWS references
Practice this interactively
Answer without seeing the solution first in the IAM Deep Dive practice session.
Practice IAM Deep Dive